{"id":"CVE-2026-123381","kind":"vulnerability","aliases":["CVE-2026-123381"],"related":[],"title":"Microsoft Outlook: stack buffer overflow allows remote code execution, fixed in November 2026 Office updates","description":"Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.","summary":"A stack-based buffer overflow in Microsoft Office Outlook lets an unauthorized attacker run code on a victim's machine across the network. The sources give no further detail on the trigger or the affected versions.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Microsoft Office LTSC 2021","fixed":["16.0.14334.21048"],"affected":"< 16.0.14334.21048","ecosystem":"vendor"},{"name":"Microsoft Office LTSC 2024","fixed":["16.0.17932.21140"],"affected":"< 16.0.17932.21140","ecosystem":"vendor"},{"name":"Microsoft 365 Apps for Enterprise","fixed":["Current Channel 2610 20527.20196"],"affected":"below the Nov 10, 2026 build for the channel (see aka.ms/OfficeSecurityReleases)","ecosystem":"vendor"}],"ecosystems":[],"tags":["microsoft-office","outlook","package","remote-code-execution","windows"],"not_affected_if":["patched-office-build"],"how_to_check":"In Outlook: File > Office Account > About Outlook and compare the build with the fixed builds (LTSC 2021 < 16.0.14334.21048, LTSC 2024 < 16.0.17932.21140, Microsoft 365 Apps below the Nov 10, 2026 build for your channel). Fleet-wide: query the Office ClickToRun VersionToReport registry value (HKLM\\SOFTWARE\\Microsoft\\Office\\ClickToRun\\Configuration).","fix":"Install the November 10, 2026 Office security update: Current Channel 2610 build 20527.20196 (Monthly Enterprise 2610: 20527.20194; 2609: 20430.20264; 2608: 20326.20320), Office LTSC 2024 build 17932.21140 (16.0.17932.21140), Office LTSC 2021 build 14334.21048 (16.0.14334.21048), Office 2019 volume licensed 10417.20236.","status":"open","published_at":"2026-11-10T19:20:41+00:00","first_seen_at":"2026-11-10T19:25:12+00:00","triaged_at":"2026-11-10T19:26:29+00:00","updated_at":"2026-11-10T21:33:33+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-10T19:26:29Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft Outlook: stack buffer overflow lets an attacker run code over network","impact":"high","summary":"A stack-based buffer overflow in Microsoft Office Outlook lets an unauthorized attacker run code on a victim's machine across the network. The sources give no further detail on the trigger or the affected versions.","audience":"everyone","category":"package","nicknames":[],"who_cares":["outlook","microsoft-office","windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs arbitrary code on the victim's machine over the network.","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-123381 for affected versions, fixed builds, and whether user interaction (such as opening a message) is required.","how_to_check":"- unknown","plain_action":"unknown","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations and people running Microsoft Office Outlook. The sources do not name affected versions or the exact trigger, so the unknown is not resolved here.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000665,"input_tokens":4498,"output_tokens":431,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-123381 for affected versions, fixed builds, and whether user interaction (such as opening a message) is required.","search":"'-123381':18A,21A '-2026':17A,20A '2021':25A '2024':29A '2026':13A '365':31A 'across':66B 'affect':80B 'allow':6A,91C 'apps':32A 'attack':58B,94C 'base':48B,84C 'buffer':4A,49B,85C 'code':8A,42B,60B,97C 'cve':16A,19A 'detail':74B 'enterprise':34A 'execut':9A,43B,96C 'fix':10A 'for':33A 'give':71B 'let':55B 'ltsc':24A,28A 'machin':65B 'microsoft':1A,22A,26A,30A,36B,52B,88C 'microsoft-offic':35B 'network':68B,100C 'novemb':12A 'offic':14A,37B,53B,89C 'office':23A,27A 'outlook':2A,38B,54B,90C 'overflow':5A,50B,86C 'packag':39B 'remot':7A,41B 'remote-code-execut':40B 'run':59B 'sourc':70B 'stack':3A,47B,83C 'stack-bas':46B,82C 'trigger':77B 'unauthor':57B,93C 'updat':15A 'version':81B 'victim':63B 'window':44B","nicknames":[],"mitigations":[],"who_affected":"Anyone running Microsoft Outlook from Microsoft 365 Apps, Office LTSC 2021 or Office LTSC 2024 on a build older than the November 10, 2026 update. The CVSS vector indicates the attacker needs the victim to take an action (user interaction required), but Microsoft's entry was not readable here, so the exact trigger (for example whether the Preview Pane is enough) is unknown. Teams that already installed the November 2026 Office update can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T21:33:33Z","by":"analyst","doc":"https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates","run_id":2812}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["365appsforenterprise","microsoft365appsforenterprise","microsoftofficeltsc2021","microsoftofficeltsc2024","officeltsc2021","officeltsc2024"],"ptokens":["2021","2024","365","apps","enterprise","for","ltsc","microsoft","office"],"labels":["high","microsoftoffice","outlook","package","remotecodeexecution","windows"],"campaign_type":null,"search_a":"'-123381':18A,21A '-2026':17A,20A '2021':25A '2024':29A '2026':13A '365':31A 'allow':6A 'apps':32A 'buffer':4A 'code':8A 'cve':16A,19A 'enterprise':34A 'execut':9A 'fix':10A 'for':33A 'ltsc':24A,28A 'microsoft':1A,22A,26A,30A 'novemb':12A 'offic':14A 'office':23A,27A 'outlook':2A 'overflow':5A 'remot':7A 'stack':3A 'updat':15A","search_b":"'across':66B 'affect':80B 'attack':58B 'base':48B 'buffer':49B 'code':42B,60B 'detail':74B 'execut':43B 'give':71B 'let':55B 'machin':65B 'microsoft':36B,52B 'microsoft-offic':35B 'network':68B 'offic':37B,53B 'outlook':38B,54B 'overflow':50B 'packag':39B 'remot':41B 'remote-code-execut':40B 'run':59B 'sourc':70B 'stack':47B 'stack-bas':46B 'trigger':77B 'unauthor':57B 'version':81B 'victim':63B 'window':44B","search_c":"'allow':91C 'attack':94C 'base':84C 'buffer':85C 'code':97C 'execut':96C 'microsoft':88C 'network':100C 'offic':89C 'outlook':90C 'overflow':86C 'stack':83C 'stack-bas':82C 'unauthor':93C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123381","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123381","severity":null,"published_at":"2026-11-10T19:20:41+00:00","modified_at":"2026-11-10T19:20:41+00:00","first_seen_at":"2026-11-10T19:25:12+00:00","fetched_at":"2026-11-10T19:25:12+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-123381:2812","url":"https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates","severity":null,"published_at":"2026-11-10T21:33:33+00:00","modified_at":"2026-11-10T21:33:33+00:00","first_seen_at":"2026-11-10T21:33:33+00:00","fetched_at":"2026-11-10T21:33:33+00:00","note":"Microsoft Learn Nov 10 2026 Office release notes list this CVE under Outlook with fixed builds; affected ranges from OpenCVE (CNA data), not verified. MSRC page is JS-only and unreadable. Not exploited: the Outlook zero-day in Patch Tuesday coverage is CVE-2026-124194 (NTLM spoofing), a different CVE. Trigger and preview-pane exposure unknown.","cites":["https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates","https://app.opencve.io/cve/CVE-2026-123381"]}],"documents":[{"id":118854,"url":"https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates","title":"Release notes for Microsoft Office security updates (Nov 10, 2026 lists CVE-2026-113759 under Word)","kind":"advisory","source":"analyst","publisher":null,"text":"November 10, 2026: Current Channel 2610 (20527.20196); MEC 2610 (20527.20194), 2609 (20430.20264), 2608 (20326.20320); SAEC 2610 (20527.20192), 2609 (20430.20262), 2608 (20326.20318); Office 2024/2021 Retail 2610 (20527.20196); LTSC 2024 2408 (17932.21140); LTSC 2021 2108 (14334.21048); Office 2019 1808 (10417.20236). CVE-2026-118301 listed under Excel.","published_at":null,"relation":"fix","confidence":null,"note":null},{"id":118933,"url":"https://app.opencve.io/cve/CVE-2026-123381","title":"OpenCVE: CVE-2026-123381","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}