Critical Remote Code Execution in Microsoft Outlook – CVE‑2026‑46023

---

Impact:

---

A remote code execution (RCE) flaw in Microsoft Outlook for Windows allows an unauthenticated attacker to execute arbitrary code on a victim’s machine. The vulnerability is actively exploited in the wild, targeting enterprise mailboxes and high‑value individuals. Microsoft rates the flaw 9.8 (Critical) on the CVSS v3.1 scale.

---

Technical Details:

---

• CVE‑2026‑46023 resides in the Outlook Message Parsing Engine. The engine processes MIME‑encoded email bodies and attachments. A specially crafted .rtf or .mht file can corrupt the internal Ole32 object handling routine, leading to a heap‑based buffer overflow.
• The overflow overwrites a function pointer in the Outlook process (OUTLOOK.EXE). When the pointer is later dereferenced, attacker‑controlled shellcode runs with the same privileges as the logged‑in user.
• Exploitation does not require user interaction beyond opening the malicious email. The payload can be delivered via a phishing campaign that embeds the malicious attachment in a seemingly benign message.
• The vulnerability is CWE‑122 (Heap‑Based Buffer Overflow) and CWE‑787 (Out‑of‑bounds Write). It bypasses Outlook’s built‑in attachment sandbox because the malicious file is interpreted as a trusted document when the user has the “Preview” pane enabled.
• A proof‑of‑concept (PoC) released on a public exploit forum demonstrates a fully automated chain: email delivery → automatic preview rendering → code execution → download of a second‑stage ransomware payload.

---

Affected Products & Versions:

---

Product	Versions Affected
Microsoft Outlook for Windows (part of Office 365, Office 2021, Office 2019)	2308 (Build 16.0.2308.0) and earlier
Outlook on Windows Server (Mailbox role)	2308 and earlier
Outlook for Microsoft 365 (Insider Fast)	Up to build 2308

No mobile or macOS versions are impacted because the vulnerable parsing component is Windows‑only.

---

Mitigation & Remediation Steps:

---

1. Apply the October 2026 Patch Tuesday update (KB5029385) no later than 24 Oct 2026. The patch replaces the vulnerable parsing library with a hardened version that validates attachment sizes before processing.
2. Disable automatic preview for email attachments in Outlook: File → Options → Trust Center → Trust Center Settings → Automatic Download → Uncheck “Don’t download pictures automatically in HTML e‑mail messages or RSS items”. This blocks the exploit path that relies on the preview pane.
3. Enforce attachment scanning at the perimeter using Microsoft Defender for Office 365 or a third‑party sandbox. Configure policies to block .rtf, .mht, and .doc files that contain embedded OLE objects from external senders.
4. Restrict user privileges: Ensure that standard users do not have local admin rights. The exploit runs in the context of the logged‑in user, so limiting privileges reduces impact.
5. Monitor for Indicators of Compromise (IOCs): Look for the following in your security logs:
   • Creation of unknown OUTLOOK.EXE child processes.
   • Network connections to known ransomware C2 domains (e.g., *.darkcrypt[.]com).
   • Presence of the file %APPDATA%\Microsoft\Outlook\Temp\payload.exe.
6. Educate users: Advise staff not to open unexpected email attachments, even if they appear to come from trusted contacts. Verify via secondary channels if suspicious.

---

Timeline:

---

• 02 Sep 2026 – Vulnerability reported to Microsoft by an external researcher.
• 08 Sep 2026 – Microsoft acknowledges receipt, assigns CVE‑2026‑46023, begins internal analysis.
• 15 Sep 2026 – Private advisory released to the Microsoft Security Response Center (MSRC) customers.
• 20 Sep 2026 – Exploit code posted publicly, confirming active exploitation.
• 24 Oct 2026 – Patch Tuesday release (KB5029385) containing the fix.
• 01 Nov 2026 – CISA adds CVE‑2026‑46023 to its Known Exploited Vulnerabilities (KEV) catalog.

---

Why It Matters:

---

Outlook is the primary email client for most enterprises. A successful RCE can give attackers a foothold inside the network, enabling lateral movement, credential theft, and ransomware deployment. The rapid weaponization of CVE‑2026‑46023 mirrors the pattern seen with earlier Outlook exploits (e.g., CVE‑2022‑30190 “Follina”). Organizations that delay patching risk immediate compromise.

---

Next Steps for Security Teams:

---

• Verify that KB5029385 is deployed across all Windows endpoints.
• Run a configuration baseline check to ensure the preview pane is disabled for external mail.
• Update Microsoft Defender for Endpoint signatures and enable Attack Surface Reduction (ASR) rule 3006 (Block Office applications from creating child processes).
• Conduct a phishing simulation focused on attachment handling to gauge user awareness.

---

References:

---

• Microsoft Security Update Guide entry for CVE‑2026‑46023
• CISA KEV Catalog entry: CVE‑2026‑46023
• Microsoft Defender for Office 365 documentation: Attachment Scanning
• Proof‑of‑Concept analysis on ExploitDB

Action: Deploy the October 2026 update immediately. Disable automatic preview. Monitor for IOCs. The window for exploitation is already open; delay equals increased risk.