Microsoft Office Outlook Remote Code Execution Vulnerability
CVE-2026-78525 is a remote code execution vulnerability in Microsoft Office Outlook (rated Critical, CVSS 8.8).
1 version
Facts
- Microsoft id
CVE-2026-78525- Products
- Microsoft Office Outlook
- Severity
- Critical
- Impact
- Remote Code Execution
- CVSS
- 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
- Exploited
- No
- Publicly disclosed
- No
- Exploitability
- Exploitation Less Likely
- Customer action required
- Yes
- Release
- 2026-Sep
- Assigned by
- Microsoft
- Weakness
- CWE-416: Use After Free
- MSRC revision
- 2.0
- Status pages
- Outlook status
- First captured by us
- (from our first import of this list)
- Microsoft last modified
- Source
- Security updates · open the original at Microsoft
Microsoft's revision notes
- Revision 1.0, 2026-09-08:
Information published.
- Revision 2.0, 2026-09-17:
Microsoft is announcing the availability of the security updates for Microsoft Office for Mac.
Microsoft says
Use after free in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. How could an attacker exploit the vulnerability?
What Microsoft changed
One version so far. If Microsoft edits it, each change shows here with what was removed and added.
First version we captured ·
The text as we first saw it
Seen by us · Microsoft's timestamp · Microsoft's page
Related changes
Mentioning the same Microsoft ids
Other changes for Outlook
- Microsoft Office Outlook Remote Code Execution Vulnerability
- Microsoft Office Outlook Remote Code Execution Vulnerability
- Microsoft Office Outlook Remote Code Execution Vulnerability
- Microsoft Office Outlook Information Disclosure Vulnerability
- Microsoft Office Outlook Remote Code Execution Vulnerability
- Microsoft Office Outlook Remote Code Execution Vulnerability
- Microsoft Office Outlook Remote Code Execution Vulnerability
- Microsoft Office Outlook Remote Code Execution Vulnerability
Last updated