Vulnerability

CERT-In Vulnerability Note CIVN-2026-0480
Remote Code Execution Vulnerability in Microsoft Outlook

Original Issue Date:September 28, 2026

Severity Rating: HIGH

Software Affected

Microsoft 365 Apps for Enterprise for 32-bit and 64-bit
Microsoft Office LTSC 2021 for 32-bit and 64-bit
Microsoft Office LTSC 2024 for 32-bit and 64-bit

Overview

A vulnerability has been reported in Microsoft Outlook which could allow a remote attacker to execute arbitrary code on the targeted system.

Target Audience:
All organizations and individuals using the above-mentioned Microsoft products.

Risk Assessment:
High risk of remote code execution.

Impact Assessment:
Potential for execute arbitrary code and compromise of affected systems.

Description

Microsoft Outlook is an email and personal information manager created by Microsoft that combines email, calendars, contact lists, and task management into a single platform.

This vulnerability exists in Microsoft Outlook due to improper input validation. A remote attacker could exploit this vulnerability by sending a specially crafted payload.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code and compromise of affected systems on the targeted system.

Solution

Apply appropriate security updates as mentioned in
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70125

Vendor Information

Microsoft
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70125

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70125

CVE Name
CVE-2026-70125

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India