A stack-based buffer overflow in Microsoft Office Outlook enables an attacker who can send a crafted network request or email attachment to a vulnerable system to execute arbitrary code. The flaw sits in Outlook’s handling of certain input data and follows CWE-121, allowing the attacker to exploit the memory corruption and gain code‑execution privileges, potentially compromising the compromised user’s account and the entire organization.

Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024. All editions of these products that include Outlook are vulnerable; no specific sub‑version range is listed, so the latest installed versions are at risk until updated.

The CVSS score of 9.8 shows attackers could achieve high‑impact remote code execution with a short attack surface. The EPSS score is not provided, but the lack of a KEV listing means the vulnerability is not yet publicly exploited at scale, yet the risk remains high. The likely attack vector is via a network‑based trigger, such as a malicious email or a crafted MIME component, because the flaw is described as exploitable “over a network.”