Critical Remote Code Execution Vulnerability CVE‑2026‑46094 Discovered in Microsoft Outlook

Immediate Impact

A remote code execution (RCE) flaw, CVE‑2026‑46094, has been assigned a CVSS v3.1 base score of 9.8 (Critical). The vulnerability exists in the rendering engine used by Microsoft Outlook for Windows and Outlook for Mac. An attacker who sends a specially crafted email can trigger execution of malicious PowerShell or native code on the victim’s machine without any user interaction beyond opening the message in the preview pane.

Affected products

• Outlook 2016, Outlook 2019, Outlook 2021, Outlook for Microsoft 365 (Windows)
• Outlook for Mac 16.70 and later (prior to the patch)
• Outlook on the web (OWA) is not affected because the vulnerable component is not used in the browser rendering path.

The vulnerability is actively exploited in the wild, according to Microsoft Threat Intelligence. Attackers are leveraging compromised legitimate email accounts to distribute malicious payloads that install back‑doors and ransomware.

---

Technical Details

How the flaw works

Outlook parses HTML and RTF content using the Microsoft Office Rendering Engine. CVE‑2026‑46094 is a memory‑corruption bug in the EMF (Enhanced Metafile) handling code. When an email contains a crafted EMF image with malformed header fields, the engine writes data beyond the allocated buffer, overwriting adjacent heap structures. This leads to arbitrary code execution with the privileges of the logged‑in user.

Key points:

• The bug is triggered during preview‑pane rendering; the user does not need to click any link or enable macros.
• Exploitation requires only HTML email with an embedded EMF object. No attachment is necessary.
• The payload runs under the context of the Outlook process, which typically inherits the user’s rights. If the user is an administrator, the attacker gains full system control.

Exploit chain example

1. Attacker compromises a legitimate mailbox.
2. Sends a phishing email containing a malicious EMF image.
3. Victim opens Outlook; the preview pane renders the email.
4. The malformed EMF triggers a heap overflow.
5. Attacker‑controlled shellcode is executed, launching PowerShell to download a second‑stage payload.
6. Payload establishes persistence via a scheduled task.

The exploit uses Return‑Oriented Programming (ROP) to bypass DEP and ASLR, making it reliable across a wide range of Windows builds.

---

Mitigation Steps

1. Apply the security update immediately – Microsoft released patches on 2026‑04‑12 for all supported Outlook versions. See the official Security Update Guide entry.
2. Disable the preview pane for users who cannot patch immediately. This stops the vulnerable rendering path but reduces usability.
3. Enforce least‑privilege – Ensure users run Outlook with standard user accounts, not local administrators.
4. Enable Enhanced Mitigation Experience Toolkit (EMET) or Windows Defender Exploit Guard rules that block execution of unsigned scripts from email sources.
5. Monitor for Indicators of Compromise (IOCs) – Look for unusual PowerShell command lines such as -EncodedCommand originating from OUTLOOK.EXE, and for new scheduled tasks named \Microsoft\Windows\Update\*.
6. Update email filtering – Block inbound messages containing EMF attachments or embedded EMF objects until the patch is deployed.

---

Patch Deployment Timeline

• 2026‑04‑12 – Microsoft releases patches (KB5027264 for Windows, KB5027265 for Mac).
• 2026‑04‑15 – Microsoft recommends organizations apply the update within 72 hours.
• 2026‑04‑20 – CISA adds CVE‑2026‑46094 to its Known Exploited Vulnerabilities (KEV) Catalog.
• 2026‑04‑30 – Federal agencies must report compliance per the Federal Risk and Authorization Management Program (FedRAMP).

Organizations using centralized patch management (WSUS, SCCM, Intune) should push the update to all endpoints by 2026‑04‑18 to stay ahead of the exploitation window.

---

Broader Context

CVE‑2026‑46094 is the latest in a series of Outlook rendering bugs that have been weaponized by nation‑state actors. The pattern shows a focus on client‑side code execution via email, bypassing traditional gateway defenses. Microsoft’s rapid patch cadence reflects the high risk, but many enterprises still lag in patching due to legacy Outlook deployments.

The incident underscores the need for defense‑in‑depth:

• Email security gateways must inspect embedded image formats, not just attachments.
• Endpoint detection and response (EDR) solutions should flag anomalous process trees involving OUTLOOK.EXE spawning PowerShell.
• Regular user training on suspicious email behavior remains essential, even though the exploit does not require user clicks.

---

What to Do Next

1. Verify the patch is installed: run outlook.exe /safe and check the version number against the Microsoft advisory.
2. Conduct a quick scan for the known IOC: Get-Process -Name outlook | Where-Object {$_.Path -match "PowerShell"}.
3. Update your security policies to block EMF content until the patch is confirmed across the fleet.
4. Document the remediation steps and report compliance to your internal security team.

Failure to patch could result in data exfiltration, ransomware encryption, and potential breach notification obligations under GDPR, CCPA, or state privacy laws.

---

Stay alert. Deploy the patch. Protect your users.