CVE-2026-69629: CWE-122: Heap-based Buffer Overflow in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-69629) is a heap-based buffer overflow in Microsoft Office Outlook within Microsoft 365 Apps for Enterprise. It enables remote code execution by an unauthorized attacker over a network, contingent on user interaction. The CVSS 3.1 base score is 8.8, indicating high severity, with attack vector network, low attack complexity, no privileges required, and user interaction needed. Microsoft has published an official fix for affected versions. The vulnerability is documented in the Microsoft Security Response Center advisory.

Successful exploitation allows an attacker to execute arbitrary code remotely with the privileges of the current user, potentially leading to full compromise of the affected system. Confidentiality, integrity, and availability impacts are all rated high. The attack requires user interaction but no prior privileges or complex conditions.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for Microsoft 365 Apps for Enterprise as detailed in the vendor advisory. Since this is a cloud service, Microsoft manages remediation for the cloud-hosted components. No additional mitigations are specified beyond applying the official patches.