CVE-2026-88156: CWE-121: Stack-based Buffer Overflow in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-88156) is a stack-based buffer overflow in Microsoft Office Outlook within Microsoft 365 Apps for Enterprise. It enables remote code execution by an unauthenticated attacker over the network. The CVSS 3.1 base score is 9.8, indicating critical severity with high impact on confidentiality, integrity, and availability. The vulnerability affects versions including =16.0.1, =1.0.0, >=16.0.1 <16.0.14334.20974, >=16.0.0 <16.0.17932.21056, and =16.0.0. Microsoft has published an official fix for this issue, and it is a cloud service where the vendor manages remediation. No known exploits in the wild have been reported at this time.

Successful exploitation allows an attacker to execute arbitrary code remotely on affected Microsoft 365 Apps for Enterprise installations, potentially leading to full system compromise. The vulnerability impacts confidentiality, integrity, and availability of the affected systems. No active exploitation has been reported yet.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft as soon as possible. Since this is a cloud service, Microsoft manages remediation server-side; verify with the Microsoft Security Response Center advisory for the latest update status and deployment guidance.