Microsoft Office Outlook Remote Code Execution Vulnerability
CVE-2026-78509 is a remote code execution vulnerability in Microsoft Office Outlook (rated Critical, CVSS 9.8).
1 version
Facts
- Microsoft id
CVE-2026-78509- Products
- Microsoft Office Outlook
- Severity
- Critical
- Impact
- Remote Code Execution
- CVSS
- 9.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
- Exploited
- No
- Publicly disclosed
- No
- Exploitability
- Exploitation Less Likely
- Customer action required
- Yes
- Release
- 2026-Sep
- Assigned by
- Microsoft
- Weakness
- CWE-122: Heap-based Buffer Overflow
- MSRC revision
- 2.0
- Status pages
- Outlook status
- First captured by us
- (from our first import of this list)
- Microsoft last modified
- Source
- Security updates · open the original at Microsoft
Microsoft's revision notes
- Revision 1.0, 2026-09-08:
Information published.
- Revision 2.0, 2026-09-17:
Microsoft is announcing the availability of the security updates for Microsoft Office for Mac.
Microsoft says
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. How could an attacker exploit this vulnerability?
What Microsoft changed
One version so far. If Microsoft edits it, each change shows here with what was removed and added.
First version we captured ·
The text as we first saw it
Seen by us · Microsoft's timestamp · Microsoft's page
Related changes
Mentioning the same Microsoft ids
Other changes for Outlook
- Microsoft Office Outlook Remote Code Execution Vulnerability
- Microsoft Office Outlook Remote Code Execution Vulnerability
- Microsoft Office Outlook Remote Code Execution Vulnerability
- Microsoft Office Outlook Information Disclosure Vulnerability
- Microsoft Office Outlook Remote Code Execution Vulnerability
- Microsoft Office Outlook Remote Code Execution Vulnerability
- Microsoft Office Outlook Remote Code Execution Vulnerability
- Microsoft Office Outlook Remote Code Execution Vulnerability
Last updated