Microsoft Office Outlook double free vulnerability allows unauthorised remote code execution (CVE-2026-97749)

What happened

Microsoft Office Outlook has a double free vulnerability (CWE-415). An unauthorised attacker who can reach an affected Outlook installation over the network could exploit it to execute code. The CVSS v3.1 vector shows a network attack, low complexity, no privileges and no user interaction, with high impact on confidentiality, integrity and availability; Microsoft rates the vulnerability Critical at 9.8. No active exploitation or public disclosure is recorded for this CVE, and it is not listed in CISA KEV. Microsoft's advisory does not publish a workaround. The SSVC assessment notes that the flaw is automatable with total technical impact, which makes it a priority patch even in the absence of known active attacks.

Who is affected

Microsoft lists three affected products. Microsoft 365 Apps for Enterprise is affected from version 16.0.1 up to, but not including, the fixed build published through the Office Security Releases channel. Microsoft Office LTSC 2021 is affected from version 16.0.1 to before build 16.0.14334.20974. Microsoft Office LTSC 2024 is affected from version 16.0.0 to before build 16.0.17932.21056. These are Outlook desktop installations in many organisations. If you run Outlook as part of Microsoft 365 Apps or an LTSC Office suite, check the channel or build on systems that can be reached from untrusted networks. Microsoft has not listed other Office products in this advisory.

What to do now

Microsoft has published fixes for all three affected products. Apply the update for the product you run:

1. Microsoft 365 Apps for Enterprise: update to the fixed channel release Microsoft identifies at https://aka.ms/OfficeSecurityReleases.
2. Microsoft Office LTSC 2021: install build 16.0.14334.20974.
3. Microsoft Office LTSC 2024: install build 16.0.17932.21056.

Because the CVSS vector indicates network reach and no user interaction, prioritise systems that can be reached from untrusted networks. Microsoft's advisory contains no workaround, so patching is the only vendor-provided remedy.

Beyond the patch

This is a network-reachable, no-interaction remote code execution flaw in a widely deployed email client. The immediate job is the patch; the longer job is knowing which systems run software at this level of exposure and how quickly your estate can absorb Microsoft's update. Our Virtual CISO Services (vCISO) can help build that exposure management routine, and Supply Chain Defense & Third-Party Risk tracks supplier patch cycles so a critical fix like this does not wait on manual discovery.