CVE-2026-97016: CWE-122: Heap-based Buffer Overflow in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability, identified as CVE-2026-97016 and classified under CWE-122, is a heap-based buffer overflow in Microsoft Office Outlook within Microsoft 365 Apps for Enterprise. It enables remote code execution by an attacker without requiring privileges or user interaction. The CVSS 3.1 base score is 9.8, indicating critical severity, with network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. Microsoft has published an official fix for affected versions.

Successful exploitation allows an attacker to execute arbitrary code remotely on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability of the impacted Microsoft 365 Apps for Enterprise installation. This can occur without any user interaction or privileges, making it highly severe.

An official fix is available from Microsoft. Users and administrators should apply the security update provided by Microsoft promptly. Since this is a cloud service, Microsoft manages remediation for cloud-hosted environments; on-premises users must update to patched versions as per the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97016.