Microsoft 365 Apps

Microsoft Patches High-Severity Outlook Flaw Allowing Remote Code Execution

Microsoft has addressed a high-severity vulnerability in Outlook tracked as CVE-2026-70329 with a CVSS score of 8.8. The flaw stems from an integer overflow during data processing that can trigger memory corruption and alter the application's execution flow. Exploitation occurs over the network without requiring authentication or privileges, though some user interaction is necessary to process the malicious content. Successful attacks grant code execution under the privileges of the logged-in user, potentially enabling malware installation, file access, data theft, or lateral movement. The issue impacts Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021, Office LTSC 2024, and Outlook 2016 on both 32-bit and 64-bit systems. A dedicated patch KB5002755 updates Outlook 2016 to build 16.0.5565.1000, while Click-to-Run versions receive fixes through standard Microsoft update channels.