---
id: "CVE-2026-123375"
page: "https://infrastack.ai/live/CVE-2026-123375"
kind: "vulnerability"
aliases: ["CVE-2026-123375"]
title: "Microsoft Outlook: stack buffer overflow lets remote attacker run code"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Microsoft Office Outlook", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["buffer-overflow", "microsoft-office", "other", "outlook", "windows"]
not_affected_if: []
published_at: "2026-11-10T19:20:40+00:00"
first_seen_at: "2026-11-10T19:25:11+00:00"
updated_at: "2026-11-10T21:35:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123375", "first_seen_at": "2026-11-10T19:25:11+00:00"}, {"source": "analyst", "url": "https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates", "first_seen_at": "2026-11-10T21:35:55+00:00", "cites": ["https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates"]}]
exploit_sources: []
---

# Microsoft Outlook: stack buffer overflow lets remote attacker run code

Link for people: https://infrastack.ai/live/CVE-2026-123375 (this .md is for agents)

A stack-based buffer overflow in Microsoft Office Outlook lets an unauthorized attacker reach the network and run code on the affected machine. NVD rates it high (CVSS 8.8), and the sources do not say whether it is exploited in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft Office Outlook affected range not listed fixed no fixed version listed

## How to check

In Outlook open File > Office Account > About Outlook and compare the version and build with the fixed builds in the fix field. Anything older on the same channel is unpatched. The sources do not say whether the preview pane is an attack vector for this CVE; the NVD vector requires user interaction.

## Fix

Install the November 10, 2026 Office update. Microsoft lists these builds: Current Channel 2610 (20527.20196); Monthly Enterprise 2610 (20527.20194), 2609 (20430.20264), 2608 (20326.20320); Semi-Annual Enterprise 2610 (20527.20192), 2609 (20430.20262), 2608 (20326.20318); Office 2024 and 2021 Retail 2610 (20527.20196); LTSC 2024 17932.21140; LTSC 2021 14334.21048; Office 2019 volume 10417.20236. MSI-based Outlook builds are not given in the sources I read.

## Timeline

- 2026-11-10T19:25:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123375
- 2026-11-10T21:35:55+00:00 analyst https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates — Could not load the MSRC page for this CVE (empty fetch). Microsoft's Office release notes list CVE-2026-123375 under Outlook in the Nov 10, 2026 updates, so the fix is those builds. Per-CVE affected range, preview-pane requirement and exploitation status are not confirmed. NVD vector says user interaction required (UI:R). The Outlook zero-day this month is CVE-2026-124194, a different CVE.

## Documents

- [fix] Microsoft Office security updates release notes (Nov 10, 2026) https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates
- [mentions] ZDI: November 2026 Security Update Review https://www.thezdi.com/blog/2026/11/10/the-november-2026-security-update-review

## From the sources

Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_