---
id: "CVE-2026-124227"
page: "https://infrastack.ai/live/CVE-2026-124227"
kind: "vulnerability"
aliases: ["CVE-2026-124227"]
title: "Microsoft Outlook: uninitialized resource lets a remote attacker run code (user interaction required)"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "Microsoft 365 Apps for Enterprise", "fixed": ["Nov 10 2026 build, e.g. Current Channel 2610 (20527.20196)"], "affected": ">= 16.0.1, below the Nov 10 2026 build for your channel", "ecosystem": "vendor"}, {"name": "Microsoft Office LTSC 2021", "fixed": ["16.0.14334.21048"], "affected": ">= 16.0.1, < 16.0.14334.21048", "ecosystem": "vendor"}, {"name": "Microsoft Office LTSC 2024", "fixed": ["16.0.17932.21140"], "affected": ">= 16.0.0, < 16.0.17932.21140", "ecosystem": "vendor"}]
ecosystems: []
tags: ["microsoft-office", "outlook", "package", "patch-tuesday", "windows"]
not_affected_if: ["outlook-web-only", "patched-build"]
published_at: "2026-11-10T19:20:49+00:00"
first_seen_at: "2026-11-10T19:25:14+00:00"
updated_at: "2026-11-10T21:26:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124227", "first_seen_at": "2026-11-10T19:25:14+00:00"}, {"source": "analyst", "url": "https://cveawg.mitre.org/api/cve/CVE-2026-124227", "first_seen_at": "2026-11-10T21:26:11+00:00", "cites": ["https://cveawg.mitre.org/api/cve/CVE-2026-124227", "https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates"]}]
exploit_sources: []
---

# Microsoft Outlook: uninitialized resource lets a remote attacker run code (user interaction required)

Link for people: https://infrastack.ai/live/CVE-2026-124227 (this .md is for agents)

Microsoft Office Outlook uses a resource before it is initialized (CWE-908). Microsoft rates it Remote Code Execution, CVSS 3.1 7.5 (network, high complexity, no privileges, user interaction required). Fixed in the November 2026 Office updates. CISA's SSVC entry records no exploitation, and no public PoC was found.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft 365 Apps for Enterprise affected >= 16.0.1, below the Nov 10 2026 build for your channel fixed Nov 10 2026 build, e.g. Current Channel 2610 (20527.20196)
- vendor:Microsoft Office LTSC 2021 affected >= 16.0.1, < 16.0.14334.21048 fixed 16.0.14334.21048
- vendor:Microsoft Office LTSC 2024 affected >= 16.0.0, < 16.0.17932.21140 fixed 16.0.17932.21140

## How to check

In Outlook go to File > Office Account > About Outlook and read the build. Microsoft 365 Apps: compare with the November 10, 2026 builds at https://aka.ms/OfficeSecurityReleases (Current Channel 2610 build 20527.20196 or later). Office LTSC 2021 is exposed below 16.0.14334.21048 and Office LTSC 2024 below 16.0.17932.21140.

## Fix

Install the November 2026 Office update: Office LTSC 2021 16.0.14334.21048, Office LTSC 2024 16.0.17932.21140, Microsoft 365 Apps to the Nov 10, 2026 build for your channel (Current Channel 2610 build 20527.20196, Monthly Enterprise 2610 20527.20194, 2609 20430.20264, 2608 20326.20320).

## Timeline

- 2026-11-10T19:25:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124227
- 2026-11-10T21:26:11+00:00 analyst https://cveawg.mitre.org/api/cve/CVE-2026-124227 — Read Microsoft's CNA CVE record and the Office security release notes (Nov 10, 2026); the MSRC page itself is JS-only and was not readable. CVSS 3.1 7.5 with UI:R, AC:H; CISA SSVC says no exploitation. Not the exploited Outlook zero-day, which is CVE-2026-124194.

## Documents

- [advisory] CVE record published by Microsoft (CNA): Outlook RCE CVE-2026-124227 https://cveawg.mitre.org/api/cve/CVE-2026-124227
- [fix] Microsoft Office security updates release notes (Nov 10, 2026) https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates

## From the sources

Use of uninitialized resource in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_