CVE-2026-70329: Microsoft Outlook RCE Vulnerability

CVE-2026-70329 Overview

CVE-2026-70329 is an integer overflow vulnerability in Microsoft Office Outlook that allows an unauthorized attacker to execute code over a network. The flaw is classified under CWE-190 (Integer Overflow or Wraparound) and requires user interaction to trigger. Successful exploitation grants the attacker the ability to run arbitrary code within the context of the Outlook process, compromising confidentiality, integrity, and availability of the affected system.

Critical Impact
An attacker can achieve remote code execution on a target workstation by delivering a crafted email or attachment that Outlook parses, without requiring prior authentication.

Affected Products

Microsoft Office Outlook (see the Microsoft CVE-2026-70329 Advisory for specific build numbers)
Additional Microsoft Office channels are enumerated in the vendor advisory
Specific CPE entries were not published in the NVD record at time of writing

Discovery Timeline

2026-08-11 - CVE-2026-70329 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-70329

Vulnerability Analysis

CVE-2026-70329 stems from an integer overflow condition in a code path Microsoft Outlook uses to parse network-delivered content. When Outlook processes a value derived from attacker-controlled input, an arithmetic operation wraps past the maximum representable integer. The wrapped value is then used in a subsequent memory operation, such as a buffer allocation or index calculation, producing an undersized buffer or an out-of-bounds access.

Exploitation requires user interaction, consistent with typical Outlook attack patterns where a victim previews or opens a crafted message. Because the attack vector is network-based and no privileges are required, an external attacker can reach the vulnerable code path by sending mail to a targeted mailbox.

Root Cause

The root cause is the absence of bounds validation on an arithmetic operation performed against untrusted input. The CWE-190 weakness class covers cases where a computed size, length, or index wraps around the numeric limit of its type. The wrapped result bypasses downstream length checks and produces a corrupted memory state that the attacker can shape into arbitrary code execution.

Attack Vector

An attacker sends a crafted email, calendar item, or attachment to a target user. When Outlook parses the malicious structure, the integer overflow triggers memory corruption in the client process. The attacker leverages this corruption to execute code with the privileges of the current user. See the Microsoft CVE-2026-70329 Advisory for parser-level details.

No public proof-of-concept exploit was available at the time of publication. EPSS data assigns the vulnerability a probability of 0.652% as of 2026-08-13.

Detection Methods for CVE-2026-70329

Indicators of Compromise

Unexpected child processes spawned by outlook.exe, particularly script interpreters such as powershell.exe, cmd.exe, or wscript.exe
Crashes or exception events in the Windows Application log referencing outlook.exe after receipt of a specific message
Outbound network connections initiated by outlook.exe to non-Microsoft infrastructure shortly after mail delivery
New persistence artifacts (Run keys, scheduled tasks, startup folder entries) written by the Outlook process

Detection Strategies

Hunt for process ancestry where outlook.exe is the parent of interpreters, rundll32.exe, or regsvr32.exe
Correlate mail-delivery telemetry with endpoint process creation events to identify weaponized messages
Alert on Outlook writing executable content to user-writable directories such as %APPDATA% or %TEMP%

Monitoring Recommendations

Ingest Microsoft 365 message trace logs and endpoint telemetry into a central data lake for cross-source correlation
Monitor Outlook add-in loads and unsigned macro execution attempts
Track mail flow from external senders that contain calendar invites, meeting objects, or unusual MIME structures

How to Mitigate CVE-2026-70329

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-70329 Advisory to all Outlook installations
Prioritize patch deployment on user workstations that receive external mail
Review recent mail-delivery telemetry for crafted messages sent before the patch was applied

Patch Information

Microsoft has published a security update through the Microsoft Security Response Center. Administrators should consult the Microsoft CVE-2026-70329 Advisory to identify the specific KB numbers and channel builds that correspond to their Outlook deployment. Updates should be deployed through Microsoft Update, Microsoft 365 Apps update channels, or enterprise management tooling such as Intune or WSUS.

Workarounds

Enable reading email in plain text format to reduce parser exposure to rich-content payloads
Block or quarantine inbound messages from untrusted external senders that contain suspicious attachment types at the mail gateway
Restrict execution of child processes from outlook.exe using Attack Surface Reduction rules such as "Block Office applications from creating child processes"
Segment high-value mailboxes and enforce Protected View and Safe Attachments policies where available

bash

# Enable the ASR rule that blocks Office applications from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled