CVE-2026-78509: CWE-122: Heap-based Buffer Overflow in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CWE-122) involves a heap-based buffer overflow in Microsoft Office Outlook, enabling remote code execution by an attacker without requiring user interaction or privileges. The flaw affects various versions of Microsoft 365 Apps for Enterprise, specifically versions before the fixed builds listed. The CVSS 3.1 score is 9.8, indicating critical severity with high impact on confidentiality, integrity, and availability. Microsoft has published an official security update to address this vulnerability.

Successful exploitation allows an attacker to execute arbitrary code remotely on the affected system, potentially leading to full compromise of the targeted machine. The vulnerability requires no privileges and no user interaction, increasing its risk. The critical CVSS score reflects the high impact on system confidentiality, integrity, and availability.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-78509 to remediate this vulnerability. Since this is a cloud service, Microsoft manages remediation for cloud-hosted components. No additional mitigation steps are indicated by the vendor.