Microsoft Office Outlook stack-based buffer overflow lets unauthenticated attackers run code (CVE-2026-88156)

What happened

Microsoft describes CVE-2026-88156 as a stack-based buffer overflow in Microsoft Office Outlook. An unauthorised attacker can trigger it over a network and execute code. The CVSS 3.1 vector is network attack, low attack complexity, no privileges and no user interaction, giving a base score of 9.8 (Critical). Confidentiality, integrity and availability are all rated high.

Microsoft has not said that the vulnerability is under active exploitation, and it is not listed in CISA's Known Exploited Vulnerabilities catalogue. The flaw is classified as CWE-121, stack-based buffer overflow.

Who is affected

Affected products are Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021 and Microsoft Office LTSC for Mac 2024. Outlook is the mail, calendar and contacts client in these suites, so affected installations are typically on user endpoints.

For Microsoft Office LTSC 2021, affected builds run from 16.0.1 up to, but not including, 16.0.14334.20974. For Microsoft Office LTSC 2024, affected builds are 16.0.0 up to, but not including, 16.0.17932.21056. Microsoft 365 Apps for Enterprise builds from 16.0.1 are affected before the Office Security Releases update is applied. Office 365 for Mac is affected from 1.0.0, Office LTSC for Mac 2021 from 16.0.1, and Office LTSC for Mac 2024 from 16.0.0, all before the current publication.

What to do now

1. Apply Microsoft's October 2026 security updates. For Microsoft 365 Apps for Enterprise, the fixed release is provided through Microsoft's Office Security Releases page.
2. For Microsoft Office LTSC 2021, deploy build 16.0.14334.20974. For Microsoft Office LTSC 2024, deploy build 16.0.17932.21056.
3. For Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021 and Microsoft Office LTSC for Mac 2024, update to the current publication Microsoft identifies as fixed. The advisory does not list numeric builds for those Mac editions.
4. Confirm the applied Office build on affected endpoints through your update management or compliance controls. Microsoft has not published a workaround.

Beyond the patch

The immediate task is to update every affected Office installation, but this CVE is also a useful test of patch velocity: a critical Office flaw with no user interaction can only be contained by knowing what is deployed and catching what happens before patching completes. Managed Detection & Response can detect code execution or follow-on activity on unpatched Outlook endpoints, while Virtual CISO Services (vCISO) helps you keep network exposure mapped and reduced. Supply Chain Defense & Third-Party Risk tracks Microsoft and other critical supplier patch cycles so your exposure window is visible.