Microsoft Outlook Double Free Vulnerability Rated Critical for Remote Code Execution

Microsoft has identified a critical remote code execution vulnerability in Microsoft Office Outlook that allows unauthorized attackers to execute code over a network. The flaw, designated CVE-2026-97749, stems from a double free error within the email client, according to the Microsoft Security Update Guide.

The National Vulnerability Database assigns a CVSS score of 9.8 to this issue, classifying it as critical. This rating reflects the severity of the double free error, categorized under CWE-415. The weakness allows an unauthorized attacker to execute code over a network, as stated in the official advisory.

Context and Background

This discovery adds to a series of high-severity issues reported in Microsoft software recently. As Threat Times reported on October 14, 2026, a heap-based buffer overflow in the Windows Error Reporting service also earned a critical 9.8 rating for remote code execution. On the same date, Threat Times covered CVE-2026-83578, a critical integer underflow flaw in Windows PowerShell that similarly allows unauthorized network attackers to run code.

The pattern of critical ratings suggests a period of heightened vulnerability exposure in Microsoft’s ecosystem. While the previous flaws affected system services and scripting tools, CVE-2026-97749 specifically targets the Outlook client. This distinction is significant because Outlook is a widely used application, potentially expanding the attack surface for organizations that rely on it.

Who Is Affected

Microsoft Office Outlook users are affected by this vulnerability. The advisory from Microsoft indicates that the flaw exists within the application. The double free error allows an attacker to execute code over a network. This remote capability increases the potential for network-based attacks against systems running the affected software.

Organizations that deploy Outlook across multiple endpoints face a broader risk profile. Because the flaw allows network-based exploitation, attackers do not need physical access to the target machine. This remote capability increases the likelihood of attacks, particularly if the vulnerability can be triggered remotely, as the advisory states it allows execution over a network.

What should you do?

Security professionals should verify the status of their Outlook deployments immediately. Since the vulnerability is rated critical, it requires attention to prevent potential compromise. Organizations should check their asset management systems to identify all instances of Outlook that may be vulnerable.

Monitoring network traffic for unusual activity is also advisable. Attackers may attempt to exploit this flaw remotely, so detecting anomalous connections or execution attempts can help mitigate damage. Limiting network exposure for Outlook clients may reduce the risk of exploitation.

What to do and how to stay safe: Microsoft

• Audit your environment to identify all devices running Microsoft Office Outlook.
• Monitor network logs for unusual outbound connections or execution attempts from Outlook processes.
• Restrict network access for Outlook clients to trusted sources where possible, once the vendor provides an update.
• Ensure that endpoint detection and response tools are configured to alert on memory corruption indicators.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-97749?

CVE-2026-97749 is a double free vulnerability in Microsoft Office Outlook that allows unauthorized attackers to execute code over a network.

How severe is this vulnerability?

The National Vulnerability Database rates CVE-2026-97749 as critical with a CVSS score of 9.8.

Is there a patch available for this flaw?

No fix has been confirmed yet in the provided source material.