{"id":"CVE-2026-111309","kind":"vulnerability","aliases":["CVE-2026-111309"],"related":[],"title":"Microsoft Outlook: invalid pointer flaw lets an attacker run code remotely","description":"Release of invalid pointer or reference in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.","summary":"Microsoft Office Outlook releases an invalid pointer or reference, a memory-handling bug. A remote, unauthenticated attacker could exploit it to execute code on the victim's machine.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Microsoft Office Outlook","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Microsoft Office LTSC 2021","fixed":["16.0.14334.21048"],"affected":">= 16.0.1, < 16.0.14334.21048","ecosystem":"vendor"},{"name":"Microsoft Office LTSC 2024","fixed":["16.0.17932.21140"],"affected":">= 16.0.0, < 16.0.17932.21140","ecosystem":"vendor"},{"name":"Microsoft 365 Apps for Enterprise","fixed":[],"affected":"16.0.1 up to the build listed at https://aka.ms/OfficeSecurityReleases","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["microsoft-365-apps","microsoft-office","office-ltsc","other","outlook","windows"],"not_affected_if":[],"how_to_check":"In Outlook: File > Office Account > About Outlook and compare the build with the fixed build: LTSC 2021 16.0.14334.21048, LTSC 2024 16.0.17932.21140; for Microsoft 365 Apps see https://aka.ms/OfficeSecurityReleases.","fix":"Update to Office LTSC 2021 build 16.0.14334.21048 or later, or LTSC 2024 build 16.0.17932.21140 or later; Microsoft 365 Apps: install the current build from the Office security release notes.","status":"open","published_at":"2026-11-10T19:18:29+00:00","first_seen_at":"2026-11-10T19:24:29+00:00","triaged_at":"2026-11-10T19:32:10+00:00","updated_at":"2026-11-11T00:24:23+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-10T19:32:10Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft Outlook: invalid pointer flaw lets an attacker run code remotely","impact":"high","summary":"Microsoft Office Outlook releases an invalid pointer or reference, a memory-handling bug. A remote, unauthenticated attacker could exploit it to execute code on the victim's machine.","audience":"everyone","category":"other","nicknames":[],"who_cares":["outlook","microsoft-office","windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker runs code on the user's computer over network","analyst_note":"Check the Microsoft Security Response Center advisory for CVE-2026-111309 for affected builds, patch versions and whether user interaction (such as opening a message) is required.","how_to_check":"unknown","plain_action":"","product_name":"Microsoft Office Outlook","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000649,"input_tokens":4498,"output_tokens":398,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Response Center advisory for CVE-2026-111309 for affected builds, patch versions and whether user interaction (such as opening a message) is required.","search":"'-111309':14A,17A '-2026':13A,16A '-365':35B '2021':24A '2024':28A '365':30A 'allow':85C 'app':36B 'apps':31A 'attack':8A,63B,88C 'bug':59B 'code':10A,69B,91C 'could':64B 'cve':12A,15A 'enterprise':33A 'execut':68B,90C 'exploit':65B 'flaw':5A 'for':32A 'handl':58B 'invalid':3A,51B,77C 'let':6A 'ltsc':23A,27A,42B 'machin':74B 'memori':57B 'memory-handl':56B 'microsoft':1A,18A,21A,25A,29A,34B,38B,46B,82C 'microsoft-offic':37B 'network':94C 'offic':39B,41B,47B,83C 'office':19A,22A,26A 'office-ltsc':40B 'outlook':2A,20A,44B,48B,84C 'pointer':4A,52B,78C 'refer':54B,80C 'releas':49B,75C 'remot':11A,61B 'run':9A 'unauthent':62B 'unauthor':87C 'victim':72B 'window':45B","nicknames":[],"mitigations":[],"who_affected":"Windows desktops running Microsoft 365 Apps for Enterprise, Office LTSC 2021 or Office LTSC 2024 with Outlook installed. CVSS vector says a network attacker needs no login but the user must interact (UI:R), probably opening or previewing a message; this is not confirmed from Microsoft's page. Teams without these Office builds can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["365appsforenterprise","microsoft365appsforenterprise","microsoftofficeltsc2021","microsoftofficeltsc2024","microsoftofficeoutlook","officeltsc2021","officeltsc2024","officeoutlook"],"ptokens":["2021","2024","365","apps","enterprise","for","ltsc","microsoft","office","outlook"],"labels":["high","microsoft365apps","microsoftoffice","officeltsc","other","outlook","vendor","windows"],"campaign_type":null,"search_a":"'-111309':14A,17A '-2026':13A,16A '2021':24A '2024':28A '365':30A 'apps':31A 'attack':8A 'code':10A 'cve':12A,15A 'enterprise':33A 'flaw':5A 'for':32A 'invalid':3A 'let':6A 'ltsc':23A,27A 'microsoft':1A,18A,21A,25A,29A 'office':19A,22A,26A 'outlook':2A,20A 'pointer':4A 'remot':11A 'run':9A","search_b":"'-365':35B 'app':36B 'attack':63B 'bug':59B 'code':69B 'could':64B 'execut':68B 'exploit':65B 'handl':58B 'invalid':51B 'ltsc':42B 'machin':74B 'memori':57B 'memory-handl':56B 'microsoft':34B,38B,46B 'microsoft-offic':37B 'offic':39B,41B,47B 'office-ltsc':40B 'outlook':44B,48B 'pointer':52B 'refer':54B 'releas':49B 'remot':61B 'unauthent':62B 'victim':72B 'window':45B","search_c":"'allow':85C 'attack':88C 'code':91C 'execut':90C 'invalid':77C 'microsoft':82C 'network':94C 'offic':83C 'outlook':84C 'pointer':78C 'refer':80C 'releas':75C 'unauthor':87C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111309","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111309","severity":null,"published_at":"2026-11-10T19:18:29+00:00","modified_at":"2026-11-10T19:18:29+00:00","first_seen_at":"2026-11-10T19:24:29+00:00","fetched_at":"2026-11-10T19:24:29+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111309:3334","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111309","severity":null,"published_at":"2026-11-11T00:24:23+00:00","modified_at":"2026-11-11T00:24:23+00:00","first_seen_at":"2026-11-11T00:24:23+00:00","fetched_at":"2026-11-11T00:24:23+00:00","note":"MSRC page is JS-only and unreadable here; versions come from NVD data supplied by Microsoft as CNA (CVSS 8.8, UI:R). No exploitation or PoC found; nothing verified. Revisit when MSRC text is readable to confirm trigger and the 365 build.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-111309"]}],"documents":[{"id":120617,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111309","title":"NVD CVE-2026-111309 (Microsoft CNA data)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}