CVE-2026-78519: Microsoft 365 Apps RCE Vulnerability

CVE-2026-78519 Overview

CVE-2026-78519 is a remote code execution vulnerability in Microsoft Office Outlook caused by the use of an uninitialized resource [CWE-908]. An unauthorized attacker can execute code over a network when a user opens or previews a crafted message. The flaw affects Microsoft 365 Apps, Office 2019, Office 2021 LTSC, Office 2024 LTSC, and Outlook 2016 on both x86 and x64 architectures. Microsoft published the advisory through the Security Update Guide and released a patch addressing the issue.

Critical Impact
Successful exploitation grants attackers the ability to run arbitrary code in the context of the current user, enabling data theft, credential compromise, and lateral movement across the enterprise.

Affected Products

Microsoft 365 Apps (Enterprise, x86 and x64)
Microsoft Office 2019, Office 2021 LTSC, and Office 2024 LTSC (x86 and x64)
Microsoft Outlook 2016 (x86 and x64)

Discovery Timeline

2026-09-08 - CVE-2026-78519 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-78519

Vulnerability Analysis

The vulnerability stems from Microsoft Outlook consuming a memory resource before it has been properly initialized. When Outlook parses a specially crafted message or attachment, the affected code path reads from a memory region that still contains stale or attacker-influenced data. This condition allows an attacker to steer program state, corrupt control data, or divert execution flow. The result is arbitrary code execution in the security context of the user running Outlook. Because the exploit path is reachable through network-delivered content, an attacker can trigger the flaw by sending a message to any targeted mailbox. The EPSS forecast places the near-term exploitation probability at 0.604%.

Root Cause

The root cause is classified as CWE-908: Use of Uninitialized Resource. Outlook allocates a data structure or buffer and then reads or processes it before all fields have been assigned defined values. Attacker-controlled input reaches the uninitialized field during message processing, producing memory corruption or logic errors that lead to code execution.

Attack Vector

Exploitation occurs over the network and requires user interaction, such as opening a malicious email or interacting with a crafted attachment. No prior authentication to the target system is required. Once the crafted content is processed by the vulnerable Outlook client, the attacker gains execution with the privileges of the current user, which is sufficient to install malware, harvest credentials, or pivot deeper into the environment. Refer to the Microsoft Security Update Guidance for CVE-2026-78519 for authoritative technical details.

Detection Methods for CVE-2026-78519

Indicators of Compromise

Unexpected child processes spawned by OUTLOOK.EXE, especially cmd.exe, powershell.exe, wscript.exe, or rundll32.exe.
Outlook crashes or Windows Error Reporting entries referencing access violations in Outlook modules shortly after message receipt.
Outbound network connections from OUTLOOK.EXE to non-Microsoft infrastructure following inbound mail from untrusted senders.
New persistence entries (Run keys, scheduled tasks, or startup files) created under the user profile immediately after Outlook activity.

Detection Strategies

Hunt for process lineage anomalies where Office binaries spawn scripting or LOLBin interpreters, aligning to MITRE ATT&CK T1566 (Phishing) and T1204 (User Execution).
Correlate email gateway telemetry with endpoint execution events to identify messages preceding suspicious Outlook behavior.
Deploy YARA and static content rules on mail flow to flag malformed MAPI, TNEF, or attachment structures targeting Outlook parsing paths.

Monitoring Recommendations

Centralize Windows Sysmon and EDR telemetry to a SIEM to observe Outlook process trees, module loads, and memory access violations.
Monitor patch compliance for Microsoft 365 Apps, Office 2019/2021/2024 LTSC, and Outlook 2016 across the fleet.
Enable Attack Surface Reduction rule reporting to identify Office applications attempting to create child processes or inject code.

How to Mitigate CVE-2026-78519

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all affected Office and Outlook installations.
Prioritize patching of endpoints belonging to executives, finance, HR, and IT administrators, who are common phishing targets.
Verify Microsoft 365 Apps update channels are current and confirm client-side build numbers post-deployment.

Patch Information

Microsoft has released updates for Microsoft 365 Apps, Office 2019, Office 2021 LTSC, Office 2024 LTSC, and Outlook 2016 (x86 and x64). Administrators should deploy the fixes through Microsoft Update, WSUS, Intune, Configuration Manager, or the Click-to-Run update channel appropriate to each product. Confirm remediation by validating the patched build version against the values listed in the Microsoft advisory.

Workarounds

Enable Outlook's Reading Pane in plain text mode to reduce automatic rendering of complex message content on unpatched clients.
Enforce Attack Surface Reduction rules that block Office applications from creating child processes and from injecting into other processes.
Route inbound mail through a gateway that strips or sandboxes active content and quarantines messages with malformed MIME, TNEF, or attachment structures.
Restrict external senders and apply stricter attachment filtering policies until patching is complete across the estate.

bash

# Configuration example: enable ASR rules to limit Outlook exploitation impact
# Block Office applications from creating child processes
Add-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled

# Block Office applications from injecting code into other processes
Add-MpPreference -AttackSurfaceReductionRules_Ids 75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84 -AttackSurfaceReductionRules_Actions Enabled

# Verify configured ASR rules
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids