This vulnerability (CVE-2026-100208) involves an integer overflow or wraparound in Microsoft Office Outlook, part of Microsoft 365 Apps for Enterprise. Exploitation could allow an attacker without privileges to execute arbitrary code remotely. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, and user interaction required, with high impact on confidentiality, integrity, and availability. Microsoft has published an official fix for affected versions 16.0.0 and 16.0.1. No active exploitation has been reported to date.

Successful exploitation of this vulnerability could lead to remote code execution by an unauthorized attacker, potentially compromising confidentiality, integrity, and availability of the affected system. This could allow attackers to run arbitrary code in the context of the user running Outlook.

An official fix is available from Microsoft. Users and administrators should apply the provided security updates for Microsoft 365 Apps for Enterprise versions 16.0.0 and 16.0.1 as soon as possible. Refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100208 for update details and guidance.