Critical Remote Code Execution Vulnerability Discovered in Microsoft Outlook (CVE‑2026‑10722)

Immediate Impact

A remote code execution (RCE) flaw in Microsoft Outlook has been assigned CVE‑2026‑10722. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical). An attacker who sends a specially crafted email can execute arbitrary code on the victim’s machine without user interaction.

Affected products include:

• Outlook 2016, Outlook 2019, Outlook 2021 (both retail and volume‑licensed builds)
• Outlook for Windows (part of Microsoft 365 subscription)
• Outlook on Windows Server 2019/2022 when used as a mail client

The flaw resides in the HTML rendering engine that processes inbound messages. A malicious payload can bypass the sandbox and launch code in the context of the logged‑in user.

Technical Details

Vulnerability Mechanics

• The bug is a use‑after‑free in the MSHTML component when handling malformed <style> tags containing Unicode escape sequences.
• When Outlook parses the email, the engine frees a buffer prematurely, then later writes attacker‑controlled data into the reclaimed memory.
• The overwritten memory includes a function pointer used by the rendering thread, allowing the attacker to redirect execution to shellcode embedded in the email body.

Exploit Path

1. Attacker crafts an email with a malicious HTML body.
2. Victim receives the email in Outlook.
3. Outlook automatically renders the preview pane (default setting).
4. The malformed HTML triggers the use‑after‑free.
5. Shellcode runs with the same privileges as the user (typically admin on corporate machines).

No user interaction beyond opening Outlook is required. The exploit works across all language packs because the vulnerability is in the core rendering engine, not locale‑specific code.

CVSS Breakdown

• Attack Vector: Network (email delivery)
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Changed (affects other processes via COM objects)
• Impact: Confidentiality, Integrity, Availability – all High

Timeline

• 2026‑04‑28: Vulnerability reported to Microsoft via the MSRC Coordinated Vulnerability Disclosure program.
• 2026‑05‑07: Microsoft confirms the issue and assigns CVE‑2026‑10722.
• 2026‑05‑14: Security Update Guide (SUG) publishes the patch for all affected Outlook versions.
• 2026‑05‑21: Advisory released to customers with mitigation guidance.

Mitigation Steps

1. Apply the Patch Immediately – Download and install the Outlook update released on 2026‑05‑14 from the Microsoft Update Catalog.
2. Disable Automatic Preview – In Outlook, go to File → Options → Trust Center → Trust Center Settings → Automatic Download and uncheck “Don’t download pictures automatically in HTML e‑mail messages” and “Disable the preview pane for untrusted messages.”
3. Enable Enhanced Security Mode – For Microsoft 365 admins, enforce Enhanced Security Mode via Exchange Online Protection to strip potentially dangerous HTML tags.
4. Deploy Email Filtering Rules – Configure Exchange or third‑party gateways to block emails containing malformed <style> tags or excessive Unicode escapes.
5. Monitor for Indicators of Compromise – Look for processes named outlook.exe spawning powershell.exe with encoded commands, or unusual network connections from client machines.

What to Do If Compromised

• Isolate the affected workstation.
• Run the Microsoft Safety Scanner to detect any dropped payloads.
• Reset user credentials and enforce MFA.
• Review audit logs in Azure AD for suspicious sign‑ins.

Broader Context

CVE‑2026‑10722 follows a trend of vulnerabilities in Microsoft’s rendering stack. Similar issues were disclosed in 2025 (CVE‑2025‑34567) affecting Word and PowerPoint. Attackers continue to exploit the trust placed in email clients to deliver RCE payloads.

Organizations should treat email clients as high‑risk attack surfaces. Regular patch cycles, strict content filtering, and user education remain essential defenses.

---

References

• Microsoft Security Update Guide entry for CVE‑2026‑10722
• Official patch download page: Outlook Security Update 2026‑05‑14
• Guidance on disabling preview pane: Microsoft Docs – Outlook security settings