by Kastro
Paper/Archive/CVE-2026-78509

CVE-2026-78509

Microsoft Microsoft 365 Apps for Enterprise — Microsoft Office Outlook Remote Code Execution Vulnerability

EPSS 1.0%CVSS 9.8
critical.is priorityof 100
42
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 62.0.620 × 2012.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

Affected

ProductAffectedFixed inSource
Microsoft 365 Apps for Enterprise16.0.1 – < 16.0.20326.2013816.0.20326.20138CNA
Microsoft Office 201919.0.0 – < 16.0.10417.2020716.0.10417.20207CNA
Microsoft Office 365 for Mac1.0.0 – < 16.113.2609143316.113.26091433CNA
Microsoft Office LTSC 202116.0.1 – < 16.0.14334.2090616.0.14334.20906CNA
Microsoft Office LTSC 202416.0.0 – < 16.0.17932.2097616.0.17932.20976CNA
Microsoft Office LTSC for Mac 202116.0.1 – < 16.113.2609143316.113.26091433CNA
Microsoft Office LTSC for Mac 202416.0.0 – < 16.113.2609143316.113.26091433CNA
Microsoft Word 201616.0.1 – < 16.0.5569.100016.0.5569.1000CNA

Scores by source

microsoft (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

patchmsrc.microsoft.com/update-guide/vulnerability/CVE-2026-78509