A double free flaw in Microsoft Office Outlook enables an unauthorized attacker to run arbitrary code by sending a specially crafted message or network request. The flaw can compromise the memory integrity of the Outlook process, allowing the attacker to take full control of the victim computer. The vulnerability is a classic instance of a memory corruption error, classified as CWE-415, and has the potential to affect confidentiality, integrity, and availability of the system.

This issue impacts Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024. All installations of these products that have not applied the relevant security update are vulnerable.

The assigned CVSS score of 9.8 indicates critical severity. No EPSS score is publicly available, and the vulnerability is not yet listed in the CISA KEV catalog, implying that known exploit code may not yet be widely distributed. The likely attack vector is remote, as the flaw can be triggered over a network connection by an attacker who can send a malicious message to an Outlook client.