{"id":"CVE-2026-123382","kind":"vulnerability","aliases":["CVE-2026-123382"],"related":[],"title":"Microsoft Outlook: untrusted pointer dereference lets a network attacker run code","description":"Untrusted pointer dereference in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.","summary":"A flaw in Microsoft Office Outlook lets an unauthorized attacker trigger an untrusted pointer dereference over the network. The sources say this allows the attacker to execute code on the affected machine.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["microsoft-office","other","outlook","windows"],"not_affected_if":["unknown"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:20:41+00:00","first_seen_at":"2026-11-10T19:25:12+00:00","triaged_at":"2026-11-10T19:26:24+00:00","updated_at":"2026-11-10T19:26:24+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-10T19:26:24Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft Outlook: untrusted pointer dereference lets a network attacker run code","impact":"high","summary":"A flaw in Microsoft Office Outlook lets an unauthorized attacker trigger an untrusted pointer dereference over the network. The sources say this allows the attacker to execute code on the affected machine.","audience":"everyone","category":"other","nicknames":[],"who_cares":["outlook","microsoft-office","windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code on the affected machine over the network","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-123382 for affected builds, fixed versions, and whether user interaction (such as opening a message) is required.","how_to_check":"- unknown","plain_action":"Update Microsoft Outlook through Microsoft's normal update channel once a fix is listed for your version; the sources do not name the fixed version.","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations and people running Microsoft Office Outlook are potentially exposed, since the flaw is reachable over a network without authentication. The sources do not say which Outlook builds or configurations are affected, so unknown.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000696,"input_tokens":4498,"output_tokens":492,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-123382 for affected builds, fixed versions, and whether user interaction (such as opening a message) is required.","search":"'-123382':14A,17A '-2026':13A,16A 'affect':54B 'allow':46B,63C 'attack':9A,33B,48B,66C 'code':11A,51B,69C 'cve':12A,15A 'derefer':5A,38B,58C 'execut':50B,68C 'flaw':25B 'let':6A,30B 'machin':55B 'microsoft':1A,19B,27B,60C 'microsoft-offic':18B 'network':8A,41B,72C 'offic':20B,28B,61C 'outlook':2A,22B,29B,62C 'pointer':4A,37B,57C 'run':10A 'say':44B 'sourc':43B 'trigger':34B 'unauthor':32B,65C 'untrust':3A,36B,56C 'window':23B","nicknames":[],"mitigations":[],"who_affected":"Organizations and people running Microsoft Office Outlook are potentially exposed, since the flaw is reachable over a network without authentication. The sources do not say which Outlook builds or configurations are affected, so unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"Update Microsoft Outlook through Microsoft's normal update channel once a fix is listed for your version; the sources do not name the fixed version.","pkeys":[],"ptokens":[],"labels":["high","microsoftoffice","other","outlook","windows"],"campaign_type":null,"search_a":"'-123382':14A,17A '-2026':13A,16A 'attack':9A 'code':11A 'cve':12A,15A 'derefer':5A 'let':6A 'microsoft':1A 'network':8A 'outlook':2A 'pointer':4A 'run':10A 'untrust':3A","search_b":"'affect':54B 'allow':46B 'attack':33B,48B 'code':51B 'derefer':38B 'execut':50B 'flaw':25B 'let':30B 'machin':55B 'microsoft':19B,27B 'microsoft-offic':18B 'network':41B 'offic':20B,28B 'outlook':22B,29B 'pointer':37B 'say':44B 'sourc':43B 'trigger':34B 'unauthor':32B 'untrust':36B 'window':23B","search_c":"'allow':63C 'attack':66C 'code':69C 'derefer':58C 'execut':68C 'microsoft':60C 'network':72C 'offic':61C 'outlook':62C 'pointer':57C 'unauthor':65C 'untrust':56C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123382","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123382","severity":null,"published_at":"2026-11-10T19:20:41+00:00","modified_at":"2026-11-10T19:20:41+00:00","first_seen_at":"2026-11-10T19:25:12+00:00","fetched_at":"2026-11-10T19:25:12+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}