CVE-2026-70281: Microsoft Outlook Information Disclosure

CVE-2026-70281 Overview

CVE-2026-70281 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Office Outlook. An unauthorized attacker can trigger the flaw over a network to disclose information from affected systems. The weakness affects confidentiality without requiring authentication or user interaction, according to the CVSS vector published by Microsoft.

Microsoft published the advisory on October 13, 2026. The vulnerability has not been observed in exploitation in the wild and is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
Remote, unauthenticated attackers can read sensitive memory contents from Outlook processes, potentially exposing message data, credentials, or other confidential information processed by the client.

Affected Products

Microsoft Office Outlook (specific builds listed in the Microsoft Security Update Guide)
Microsoft 365 Apps deployments that include the Outlook component
On-premises Outlook installations distributed through Microsoft Office channels

Discovery Timeline

2026-10-13 - CVE-2026-70281 published to the National Vulnerability Database
2026-10-13 - Microsoft publishes the Microsoft Security Update CVE-2026-70281 advisory
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-70281

Vulnerability Analysis

The flaw is an out-of-bounds read within Microsoft Office Outlook's message parsing logic. When Outlook processes a crafted item delivered over a network transport, the code reads beyond the bounds of an allocated buffer. The resulting memory contents can be returned to the attacker or inferred through client behavior.

The impact is limited to information disclosure. The CVSS vector indicates no impact on integrity or availability, meaning the vulnerability does not permit code execution or service disruption on its own. Disclosed memory may contain fragments of other messages, authentication material, or application state that supports follow-on attacks.

The EPSS model estimates a 1.009% probability of exploitation in the next 30 days.

Root Cause

Out-of-bounds read issues [CWE-125] occur when software calculates or trusts an index or length without validating it against the actual buffer size. In Outlook, the condition is reached while parsing attacker-controlled content delivered through the network-facing mail workflow. Microsoft has not publicly disclosed the specific parser or structure involved.

Attack Vector

The attack vector is network-based with low complexity and no privileges or user interaction required, per the CVSS metrics. An attacker sends a crafted message or structure to a victim's Outlook client. Outlook processes the content and leaks memory contents through a response channel or observable behavior.

No public proof-of-concept, exploit code, or Exploit-DB entry is available for CVE-2026-70281 at the time of publication. Refer to the Microsoft Security Update CVE-2026-70281 advisory for authoritative technical details.

Detection Methods for CVE-2026-70281

Indicators of Compromise

Inbound email items with malformed MIME structures, oversized headers, or abnormal property streams that cause repeated Outlook parsing errors.
Unexpected Outlook client crashes, hangs, or exception events correlated with receipt of a specific message or sender.
Outbound network connections from OUTLOOK.EXE to previously unseen domains shortly after a suspect message is opened or previewed.

Detection Strategies

Inspect mail flow logs for messages with anomalous attachment structures or non-standard MAPI properties and route them for sandbox analysis.
Monitor endpoint telemetry for abnormal memory access faults or Windows Error Reporting events generated by OUTLOOK.EXE.
Alert on new or rare parent-child process relationships involving Outlook that may indicate chained exploitation attempts.

Monitoring Recommendations

Enable detailed Office telemetry and forward Outlook application and crash events to the SIEM for correlation.
Review Microsoft Defender for Office 365 and mail gateway alerts for malformed message detections targeting Outlook clients.
Track Outlook version and patch state across the fleet to identify unpatched endpoints exposed to network-delivered content.

How to Mitigate CVE-2026-70281

Immediate Actions Required

Apply the Microsoft security update for CVE-2026-70281 across all Outlook installations as described in the Microsoft Security Update Guide.
Prioritize patching for users who receive mail from external senders or operate high-value mailboxes.
Validate update deployment through configuration management reporting and endpoint compliance checks.

Patch Information

Microsoft released a security update addressing CVE-2026-70281 on October 13, 2026. Refer to the Microsoft Security Update Guide entry for CVE-2026-70281 for the authoritative list of affected builds, update KB identifiers, and channel-specific guidance for Microsoft 365 Apps, Office LTSC, and standalone Outlook deployments.

Workarounds

Enable Outlook's reading pane protections and disable automatic preview for messages from untrusted sources until patches are applied.
Enforce strict mail gateway filtering to block or quarantine messages with malformed MIME or oversized header structures.
Restrict external mail delivery to Outlook clients that are confirmed patched through endpoint compliance policies.

bash

# Verify installed Office click-to-run version on Windows endpoints
reg query "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" /v VersionToReport

# Trigger an immediate Office update check
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /update user