CVE-2026-97749
9.8CriticalPublished 13 Oct 2026 · NVD status: Analyzed · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-415
Impact
Remote attackers can execute arbitrary code over the network without authentication or user interaction. They only need network connectivity to reach the vulnerable Outlook instance.
Root cause
A double free condition (CWE-415) in Microsoft Office Outlook leads to memory corruption.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Install the Microsoft Office security update for this CVE from the vendor advisory. If patching must wait, block untrusted inbound traffic to Outlook endpoints or disconnect vulnerable hosts from external networks.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Double free in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.