CVE-2026-97749: CWE-415: Double Free in Microsoft Microsoft 365 Apps for Enterprise

CVE-2026-97749 is a double free vulnerability (CWE-415) affecting Microsoft Office Outlook in Microsoft 365 Apps for Enterprise. An attacker can exploit this flaw remotely to execute arbitrary code without requiring privileges or user interaction. The vulnerability is rated critical with a CVSS 3.1 base score of 9.8, reflecting network attack vector, low attack complexity, no privileges required, and no user interaction needed. Microsoft has published an official fix and manages remediation for this cloud-hosted service. The affected versions include =16.0.1, >=16.0.1 <16.0.14334.20974, and >=16.0.0 <16.0.17932.21056.

Successful exploitation allows remote code execution with full impact on confidentiality, integrity, and availability of the affected system. This can lead to complete compromise of the targeted Microsoft 365 Apps for Enterprise environment via Outlook. The vulnerability requires no privileges or user interaction, increasing its severity.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft as detailed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97749. Since this is a cloud-hosted service, Microsoft manages remediation server-side. No additional mitigation steps are required beyond applying the official fix.