CVE-2026-80073: Microsoft 365 Apps Information Disclosure

CVE-2026-80073 Overview

CVE-2026-80073 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Office Outlook. An unauthorized attacker can disclose information over a network when a user opens or previews a crafted message. The flaw affects multiple Microsoft Office product families, including Microsoft 365 Apps, Office 2019, Office 2021, Office 2024, and Outlook 2016. Exploitation requires user interaction but no prior authentication.

Critical Impact
Successful exploitation leaks confidential memory contents from the Outlook process, potentially exposing message data, tokens, or other in-memory secrets to a remote attacker.

Affected Products

Microsoft 365 Apps (Enterprise, x86 and x64)
Microsoft Office 2019, Office 2021 LTSC, and Office 2024 LTSC
Microsoft Outlook 2016 (x86 and x64)

Discovery Timeline

2026-09-08 - CVE-2026-80073 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-80073

Vulnerability Analysis

The vulnerability is an out-of-bounds read in Outlook's message parsing logic. When Outlook processes a crafted email, it reads memory beyond the intended buffer boundary. The read data is then reflected back through the rendering or protocol path, exposing adjacent process memory to the attacker. The issue is classified under [CWE-125] Out-of-bounds Read.

Exploitation targets confidentiality only. The attack does not modify data or crash the client, which makes detection through user-facing behavior unlikely. Leaked bytes can include cached credentials, authentication tokens, message fragments, or heap metadata useful for chaining with other vulnerabilities.

Root Cause

The root cause is missing or incorrect bounds validation when Outlook parses a malformed field within a message structure. A length or offset value supplied inside the message is trusted without verification against the actual buffer size. The parser then reads past the allocation boundary before returning the data to a higher-level handler.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker sends a specially crafted email to a target Outlook user. When the recipient opens or previews the message, the vulnerable parsing routine executes and leaks memory contents. No authentication or elevated privileges are required on the target system. Refer to the Microsoft CVE-2026-80073 Advisory for vendor technical details.

Detection Methods for CVE-2026-80073

Indicators of Compromise

Inbound email messages containing malformed MAPI, TNEF, or MIME structures with abnormal length or offset fields.
Unexpected outbound network traffic from OUTLOOK.EXE following receipt or preview of an untrusted message.
Repeated Outlook parsing errors or Watson crash reports referencing memory access exceptions in message handling libraries.

Detection Strategies

Inspect mail flow at the secure email gateway for messages with malformed headers, oversized property values, or unusual attachment structures.
Monitor endpoints for anomalous child processes or memory access patterns spawned from OUTLOOK.EXE during message rendering.
Correlate email delivery events with subsequent outbound connections from the Outlook process to untrusted destinations.

Monitoring Recommendations

Ingest Microsoft 365 and Exchange audit logs into a centralized SIEM for retrospective hunting against sender reputation and message anomalies.
Track Office application version telemetry to identify unpatched Outlook installations across the estate.
Alert on Outlook process crashes or exception events correlated with recent inbound mail from external senders.

How to Mitigate CVE-2026-80073

Immediate Actions Required

Apply the Microsoft security updates referenced in the Microsoft CVE-2026-80073 Advisory to all affected Office and Outlook installations.
Prioritize patch deployment for users with access to sensitive mailboxes, executive accounts, and shared inboxes.
Enable automatic updates for Microsoft 365 Apps to reduce exposure windows for future Office vulnerabilities.

Patch Information

Microsoft has published fixes through the Microsoft Security Response Center. Administrators should deploy the latest cumulative updates for Microsoft 365 Apps, Office 2019, Office 2021 LTSC, Office 2024 LTSC, and Outlook 2016. Consult the vendor advisory for the specific build numbers that remediate CVE-2026-80073.

Workarounds

Disable the Outlook Reading Pane to prevent automatic message parsing before a user explicitly opens a message.
Enforce plain text reading for messages received from external or untrusted senders where operationally feasible.
Restrict inbound mail from unauthenticated senders and apply strict attachment and content filtering at the mail gateway.

bash

# Disable the Outlook Reading Pane via Group Policy registry setting
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Outlook\Options" /v "DisableReadingPane" /t REG_DWORD /d 1 /f

# Force plain text reading for messages from untrusted senders
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Outlook\Options\Mail" /v "ReadAsPlain" /t REG_DWORD /d 1 /f