---
id: "CVE-2026-119995"
page: "https://infrastack.ai/live/CVE-2026-119995"
kind: "vulnerability"
aliases: ["CVE-2026-119995"]
title: "Microsoft Outlook: heap buffer overflow lets remote attacker run code"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Microsoft 365 Apps for Enterprise", "fixed": ["Nov 10 2026 build, see aka.ms/OfficeSecurityReleases"], "affected": ">= 16.0.1, < Nov 10 2026 build for the channel", "ecosystem": "vendor"}, {"name": "Microsoft Office LTSC 2021", "fixed": ["16.0.14334.21048"], "affected": ">= 16.0.1, < 16.0.14334.21048", "ecosystem": "vendor"}, {"name": "Microsoft Office LTSC 2024", "fixed": ["16.0.17932.21140"], "affected": ">= 16.0.0, < 16.0.17932.21140", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["microsoft-office", "other", "outlook", "rce", "windows"]
not_affected_if: ["outlook-web-only", "patched-nov-2026-build"]
published_at: "2026-11-10T19:20:24+00:00"
first_seen_at: "2026-11-10T19:25:07+00:00"
updated_at: "2026-11-10T22:08:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119995", "first_seen_at": "2026-11-10T19:25:07+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/cve-2026-119995", "first_seen_at": "2026-11-10T22:08:17+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/cve-2026-119995", "https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates"]}]
exploit_sources: []
---

# Microsoft Outlook: heap buffer overflow lets remote attacker run code

Link for people: https://infrastack.ai/live/CVE-2026-119995 (this .md is for agents)

Heap-based buffer overflow (CWE-122, with integer overflow CWE-190) in Microsoft Outlook lets an unauthenticated attacker run code over a network. Microsoft rates it CVSS 7.5: high attack complexity and user interaction required. Fixed in the November 10, 2026 Office security updates. No exploitation or public PoC found. Whether the preview pane is a trigger is not stated in the sources I could read.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft 365 Apps for Enterprise affected >= 16.0.1, < Nov 10 2026 build for the channel fixed Nov 10 2026 build, see aka.ms/OfficeSecurityReleases
- vendor:Microsoft Office LTSC 2021 affected >= 16.0.1, < 16.0.14334.21048 fixed 16.0.14334.21048
- vendor:Microsoft Office LTSC 2024 affected >= 16.0.0, < 16.0.17932.21140 fixed 16.0.17932.21140

## How to check

In Outlook, go to File > Office Account > About Outlook and compare the build to the fixed one for your channel. LTSC 2024 needs 16.0.17932.21140 or later. LTSC 2021 needs 16.0.14334.21048 or later. Microsoft 365 Apps need the Nov 10, 2026 build for your channel (Current Channel 2610 build 20527.20196; see aka.ms/OfficeSecurityReleases for the others). Also check Office 2021/2024 Retail and Office 2019 if you run them: the release notes list builds for them, but the CVE ranges I read name only 365 Apps, LTSC 2021 and LTSC 2024.

## Fix

Install the November 10, 2026 Office update. LTSC 2024: 16.0.17932.21140. LTSC 2021: 16.0.14334.21048. Microsoft 365 Apps: the Nov 10 build for your channel (e.g. Current Channel 2610, build 20527.20196).

## Timeline

- 2026-11-10T19:25:07+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119995
- 2026-11-10T22:08:17+00:00 analyst https://nvd.nist.gov/vuln/detail/cve-2026-119995 — Microsoft Learn Office release notes (Nov 10 2026) list this CVE under Outlook; NVD carries Microsoft CNA ranges. MSRC page not readable, so preview pane/trigger details unknown. Not exploited per sources; the Outlook zero-day in Patch Tuesday coverage is a different spoofing CVE.

## Documents

- [describes] NVD CVE-2026-119995 (Microsoft CNA data) https://nvd.nist.gov/vuln/detail/cve-2026-119995
- [fix] Microsoft Office security updates release notes (Nov 10, 2026) https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates

## From the sources

Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_