CVE-2026-78525: CWE-416: Use After Free in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-78525) is a use-after-free issue (CWE-416) in Microsoft Office Outlook, part of Microsoft 365 Apps for Enterprise. It enables an attacker to execute arbitrary code remotely without privileges, requiring user interaction. The CVSS 3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, no privileges required, and user interaction needed. The vulnerability affects multiple version ranges of Microsoft 365 Apps for Enterprise prior to fixed builds. Microsoft has published an official fix and manages remediation for this cloud service.

Successful exploitation allows remote code execution with high impact on confidentiality, integrity, and availability. An attacker can execute arbitrary code in the context of the current user, potentially leading to full system compromise.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft as detailed in the vendor advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-78525). Since this is a cloud-hosted service, Microsoft manages remediation server-side. No additional mitigation steps are required beyond applying the official fix.