Microsoft Outlook heap buffer overflow enables unauthenticated remote code execution (CVE-2026-97016)

What happened

Microsoft has disclosed a critical remote code execution vulnerability in Microsoft Office Outlook. The flaw is a heap-based buffer overflow (CWE-122) that allows an unauthorized attacker to execute code over a network. The CVSS 3.1 vector scores 9.8; the attack requires no privileges and no user interaction, and a successful exploit can result in high impact to confidentiality, integrity and availability. Microsoft rates the issue Critical.

No exploitation in the wild has been reported, and the vulnerability is not listed in CISA's KEV. Microsoft's advisory does not describe a workaround.

Who is affected

Microsoft lists three affected deployments. Microsoft 365 Apps for Enterprise: versions 16.0.1 to before the fixed release at https://aka.ms/OfficeSecurityReleases. Microsoft Office LTSC 2021: versions 16.0.1 to before 16.0.14334.20974. Microsoft Office LTSC 2024: versions 16.0.0 to before 16.0.17932.21056. These are enterprise Office channels, so verify the installed version on every managed endpoint. The fixed releases are provided below.

What to do now

1. Inventory all devices running Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, or Microsoft Office LTSC 2024.
2. Apply the fixed releases:

• Microsoft 365 Apps for Enterprise: update via https://aka.ms/OfficeSecurityReleases.
• Microsoft Office LTSC 2021: update to 16.0.14334.20974.
• Microsoft Office LTSC 2024: update to 16.0.17932.21056.

1. Microsoft has not published a workaround for this CVE. If you cannot patch immediately, restrict network access to vulnerable Outlook clients and monitor for unexpected connections until the update is deployed.
2. Confirm the update succeeded by checking the installed build number against the fixed versions above.

Beyond the patch

Because this vulnerability is reachable over the network without credentials, it is primarily an exposure problem. Virtual CISO Services (vCISO) helps you find exposed services or open paths before an attacker can reach them. If exploitation does occur, the post-exploitation activity—code execution, privilege escalation or credential abuse—is what Managed Detection & Response (MDR) is designed to detect. Organisations that rely on managed service providers for Office patching should also use Supply Chain Defense & Third-Party Risk to confirm the patch cycle, since a supplier's delay is your exposure window.