---
id: "CVE-2026-123379"
page: "https://infrastack.ai/live/CVE-2026-123379"
kind: "vulnerability"
aliases: ["CVE-2026-123379"]
title: "Microsoft Outlook: heap buffer overflow lets a remote attacker run code"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["microsoft-office", "other", "outlook", "windows"]
not_affected_if: []
published_at: "2026-11-10T19:20:41+00:00"
first_seen_at: "2026-11-10T19:25:12+00:00"
updated_at: "2026-11-10T21:34:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123379", "first_seen_at": "2026-11-10T19:25:12+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123379", "first_seen_at": "2026-11-10T21:34:21+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-123379"]}]
exploit_sources: []
---

# Microsoft Outlook: heap buffer overflow lets a remote attacker run code

Link for people: https://infrastack.ai/live/CVE-2026-123379 (this .md is for agents)

A heap-based buffer overflow in Microsoft Office Outlook lets an unauthenticated attacker over a network trigger memory corruption. The sources say an attacker can execute code on the affected machine.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

unknown: Microsoft's advisory text for affected Outlook builds was not readable. Check File > Office Account > About Outlook for your build and compare with the MSRC page for CVE-2026-123379. Microsoft shipped Office security updates on 2026-11-10 (Learn: Office security update release notes), but that page does not tie them to this CVE.

## Timeline

- 2026-11-10T19:25:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123379
- 2026-11-10T21:34:21+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-123379 — MSRC page is JS-only and returned nothing via web-cli; CVRF API also empty; ZDI Nov 2026 review (truncated) and Learn Office release notes do not map this CVE to builds. Only NVD vector read: AV:N/AC:H/PR:N/UI:R, so user interaction IS required. No affected versions or fixed builds confirmed. Not marked verified. Revisit with MSRC text (browser-cli) for versions/fix. Not the exploited Outlook zero-day CVE-2026-124194.

## Documents

- [describes] NVD CVE-2026-123379 https://nvd.nist.gov/vuln/detail/CVE-2026-123379

## From the sources

Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_