This vulnerability (CVE-2026-78519) is classified under CWE-908 (Use of Uninitialized Resource) and affects Microsoft Office Outlook as part of Microsoft 365 Apps for Enterprise. The flaw allows remote code execution by leveraging an uninitialized resource, potentially enabling an attacker to execute arbitrary code over a network without privileges and with low attack complexity. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high impact on confidentiality, integrity, and availability. Microsoft has issued an official fix for this vulnerability, and it is applicable to version 16.0.1 of the product. The service is cloud-hosted, and Microsoft manages remediation for the cloud environment.

Successful exploitation of this vulnerability could allow an unauthorized attacker to execute arbitrary code remotely on the affected system, leading to full compromise of confidentiality, integrity, and availability of the impacted Microsoft 365 Apps for Enterprise instance. The vulnerability requires no privileges and has low attack complexity but requires user interaction. There are currently no known exploits in the wild.

An official fix is available from Microsoft for this vulnerability. Users and administrators should apply the provided security update for Microsoft 365 Apps for Enterprise version 16.0.1 as soon as possible. Since this is a cloud service, Microsoft manages remediation for the cloud-hosted environment. Refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-78519 for detailed update instructions and confirmation of patch status.