Microsoft has disclosed a new remote code execution vulnerability in Outlook as part of its August 2026 Patch Tuesday release. Tracked as CVE-2026-70329, the flaw carries a CVSS v3.1 score of 8.8 — high severity — and stems from an integer overflow weakness in how Outlook processes certain file data, giving an attacker a path to run arbitrary code on a victim’s machine.

How the Attack Works

Exploiting the bug requires convincing a target to open a maliciously crafted Office file, most likely disguised as an ordinary email attachment. Microsoft’s advisory confirms the flaw has not been previously disclosed and there’s no evidence of active exploitation so far. The company’s own exploitability assessment currently rates exploitation as “unlikely,” though Microsoft and independent researchers alike caution that such ratings can change quickly once proof-of-concept code or a working exploit chain surfaces publicly.

Because the attack depends on user interaction, it can’t fire automatically the way a true zero-click exploit would. An attacker still has to get the crafted file in front of a target and talk them into opening it — typically through a phishing email. Once opened, the integer overflow can be triggered to corrupt memory and hijack the program’s execution, potentially handing the attacker control over the affected system depending on what privileges the logged-in victim holds. It’s a pattern security teams have seen many times before in Outlook and Office memory-corruption bugs, where social engineering remains the actual point of failure rather than any unauthenticated network-based trigger.

What’s Affected

The patch spans a broad slice of Microsoft’s Office ecosystem. Affected products include Microsoft 365 Apps for Enterprise on both 32-bit and 64-bit systems, Office 2019 in both architectures, Office LTSC 2021 and LTSC 2024 for 32-bit and 64-bit editions, and standalone Outlook 2016 releases on both architectures. For Outlook 2016 specifically, Microsoft published the fix under Knowledge Base article 5002755, bringing affected builds up to version 16.0.5565.1000.

Deployment differs depending on how Outlook is installed. Click-to-Run editions, which cover most modern Microsoft 365 subscriptions, update automatically through Microsoft’s normal servicing channel. Standalone installations that use the older MSI-based installer, more common in enterprise environments with locked-down deployment processes, require IT teams to push the update manually.

Part of a Bigger Update

CVE-2026-70329 is one of 394 vulnerabilities Microsoft addressed in its August 2026 security update cycle, a release that also fixed three separate zero-day flaws across other product lines, including one already being actively exploited by North Korea’s Lazarus group. The Outlook fix arrives alongside a lower-severity Outlook spoofing bug, CVE-2026-62882, rated 4.3 on the CVSS scale, plus several information-disclosure fixes touching Excel, Word, and PowerPoint. Microsoft credited an anonymous researcher with reporting the RCE flaw through its coordinated vulnerability disclosure program.

Why Organizations Shouldn’t Wait

An 8.8 CVSS score puts this squarely in the category of flaws that security teams should not deprioritize simply because Microsoft currently rates exploitation as unlikely. Email attachments remain one of the most consistently effective delivery mechanisms for attackers precisely because they only need one employee, out of potentially thousands, to open the wrong file. Once a working exploit for a bug like this becomes public — something that has historically happened within weeks for high-severity Office memory-corruption flaws — the window between disclosure and mass exploitation attempts can close fast.

Recommended Steps

• Apply the August 2026 cumulative update across all Outlook and Office installations, prioritizing standalone MSI-based deployments that don’t update automatically.
• Confirm Outlook 2016 installations are updated to build 16.0.5565.1000 or later via KB5002755.
• Reinforce attachment-handling guidance for employees, particularly around unexpected Office files arriving from unfamiliar senders.
• Layer in attachment sandboxing or detonation tooling at the email gateway level to catch crafted files before they reach end users.
• Track public disclosure and exploit-availability signals for CVE-2026-70329, since Microsoft’s “unlikely” exploitability rating is a snapshot, not a guarantee.

With phishing-delivered Office exploits remaining one of the most reliable entry points into corporate networks, this Outlook fix deserves a spot near the top of this month’s patching queue — right alongside the actively exploited Windows kernel zero-day patched in the same release.