Microsoft Office Outlook double free allows unauthenticated remote code execution (CVE-2026-97749)

What happened

CVE-2026-97749 is a double free (CWE-415) in Microsoft Office Outlook. The CVSS 3.1 vector describes a network attack with low complexity, no privileges and no user interaction, so an unauthorised attacker can execute code without first authenticating. A successful exploit can compromise confidentiality, integrity and availability; Microsoft rates the issue critical, with a base score of 9.8.

Microsoft has not reported exploitation or public disclosure for this vulnerability. It is not currently listed in CISA's KEV catalogue.

Who is affected

The affected products are:

• Microsoft 365 Apps for Enterprise, from 16.0.1 through versions before Microsoft's Office Security Releases update.
• Microsoft Office LTSC 2021, from 16.0.1 through versions before build 16.0.14334.20974.
• Microsoft Office LTSC 2024, from 16.0.0 through versions before build 16.0.17932.21056.

Outlook is the standard mail client in these editions, so organisations running any of them should verify their builds against the fixed versions below.

What to do now

1. Apply the relevant update: for Microsoft 365 Apps for Enterprise, use the update listed on Microsoft's Office Security Releases page; for Office LTSC 2021, update to 16.0.14334.20974; for Office LTSC 2024, update to 16.0.17932.21056.
2. Prioritise endpoints where Outlook is reachable from untrusted networks.
3. Microsoft has not published a workaround. If you cannot patch immediately, restrict network access to affected Outlook clients and monitor for unexpected Outlook activity.
4. Verify completion by confirming the installed build matches the fixed versions above.

How to detect it

Microsoft's advisory does not include indicators of compromise for this CVE. Detection should begin with asset discovery: identify Outlook installations on the affected builds, and confirm that the update is present. Given the code execution impact, endpoint monitoring for unexpected processes or network connections from Outlook is a reasonable precaution while no specific indicators are published.

Beyond the patch

This is a pre-authentication, network-reachable code execution flaw in a widely deployed mail client. Patching is the immediate step; the broader control is knowing exactly where affected Office builds are in your estate and proving they move to the fixed versions. Virtual CISO Services (vCISO) provides that exposure management discipline. If exploitation does occur, Managed Detection & Response (MDR) supplies EDR and SIEM monitoring to detect the code execution and follow-on activity.