Critical Remote Code Execution in Microsoft Outlook – CVE‑2026‑11332

Immediate Impact

A remote code execution (RCE) vulnerability has been identified in Microsoft Outlook. The flaw, tracked as CVE‑2026‑11332, allows an unauthenticated attacker to execute arbitrary code on a victim’s machine simply by delivering a specially crafted email. The CVSS v3.1 base score is 9.8 (Critical).

Affected Products and Versions

Product	Versions Affected
Microsoft Outlook (desktop)	Outlook 2016, Outlook 2019, Outlook 2021, Outlook for Microsoft 365 (all current channel builds)
Outlook on the web (OWA)	All supported OWA deployments
Outlook for iOS/Android	Versions released before 2026‑09‑01

All products that render HTML email content are vulnerable. The issue is present in the legacy rendering engine and the newer Chromium‑based engine when fallback to legacy mode occurs.

Technical Details

1. Root Cause – The vulnerability resides in the HTML parsing component of Outlook. When processing a malformed <script> tag that contains a specially crafted Unicode escape sequence, the parser fails to properly validate the attribute length, leading to a heap‑based buffer overflow.
2. Exploit Flow –
   • Attacker sends a malicious email to the target.
   • Victim opens the email in Outlook or OWA. No user interaction beyond opening the message is required.
   • The overflow overwrites a function pointer in the heap, redirecting execution to attacker‑controlled shellcode.
   • The shellcode runs with the same privileges as the Outlook process, typically the logged‑in user’s context, which often includes administrative rights on a domain‑joined workstation.
3. Why It Works – Outlook runs with high‑integrity privileges to access the mailbox store. The parsing component is written in native C++ and lacks proper bounds checking for Unicode‑escaped attribute values. The vulnerability was introduced in the 2023 codebase when Microsoft added support for extended Unicode ranges.

Mitigation Steps

Step	Action
1. Apply the September 2026 Security Update	Download and install the patch from the Microsoft Update Catalog or via Windows Update. The update is labeled KB5029387 for Outlook desktop and KB5029390 for OWA.
2. Disable Legacy HTML Rendering (temporary)	In Outlook, go to File → Options → Trust Center → Trust Center Settings → Email Security and uncheck “Enable legacy HTML rendering”. This blocks the vulnerable code path but may affect the display of older HTML emails.
3. Enforce Safe Attachments Policies	Use Microsoft Defender for Office 365 Safe Attachments policies to sandbox all inbound emails. This prevents malicious payloads from reaching the client.
4. Restrict Macro Execution	Ensure that Office macro settings are set to “Disable all macros without notification” for non‑business users. While the exploit does not rely on macros, it reduces the attack surface.
5. Monitor for Indicators of Compromise	Look for process creation events where outlook.exe spawns powershell.exe or cmd.exe with unusual command‑line arguments. Deploy these detection rules in Microsoft Sentinel or your SIEM.

Timeline

• 2026‑08‑15 – Microsoft Security Response Center (MSRC) receives private disclosure.
• 2026‑08‑22 – Internal analysis confirms remote code execution potential.
• 2026‑09‑01 – Public advisory released and patches built.
• 2026‑09‑07 – Patches become generally available via Windows Update.
• 2026‑09‑14 – CISA adds CVE‑2026‑11332 to its Known Exploited Vulnerabilities (KEV) catalog.

What to Do Now

1. Verify that the September 2026 update is installed on all Outlook clients.
2. If patching cannot be completed within 48 hours, enable the temporary mitigation to block legacy HTML rendering.
3. Review email security policies and ensure Safe Attachments is active.
4. Conduct a rapid scan for IOCs using Microsoft Defender for Endpoint.
5. Communicate the required actions to all end‑users; include a short guide on disabling legacy rendering.

Broader Context

CVE‑2026‑11332 is the latest in a series of Outlook rendering bugs that have been weaponized in targeted phishing campaigns. The rapid exploitation of similar flaws in 2024 and 2025 underscores the need for continuous patching and defense‑in‑depth email security. Organizations that rely on legacy email clients or disabled automatic updates are at heightened risk.

References

• Microsoft Security Advisory: CVE‑2026‑11332 Details
• CISA KEV Catalog entry: CVE‑2026‑11332
• Microsoft Defender for Office 365 documentation: Safe Attachments
• Patch download page: KB5029387 / KB5029390