Microsoft has released a security update to address a high-severity vulnerability in Outlook that could allow remote code execution on affected systems. The flaw, identified as CVE-2026-70329, carries a CVSS score of 8.8 and stems from an integer overflow during the processing of specially crafted data.
An attacker can prepare malicious content capable of causing memory corruption and redirecting the normal execution flow of the application. The vulnerability can be exploited over the network and does not require the attacker to possess any account or elevated privileges on the target system. However, successful exploitation does require a certain level of interaction from the victim to trigger processing of the malicious payload.
Once exploited, the attacker gains the ability to execute arbitrary code with the permissions of the currently logged-in user. From that point, threat actors could install malware, access sensitive files, exfiltrate data, or leverage the compromised device as an entry point for further attacks within the network.
The vulnerability affects Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021, Office LTSC 2024, and Outlook 2016 on both 32-bit and 64-bit platforms. For Outlook 2016, the fix is delivered through the update package KB5002755, which upgrades the application to build 16.0.5565.1000. Versions installed via Click-to-Run receive the patches through Microsoft’s regular maintenance channels.
