Microsoft Outlook Vulnerability Allows Attackers to Execute Malicious Code Remotely

Microsoft disclosed CVE-2026-70329, a high-severity (CVSS v3.1 8.8) integer-overflow RCE in Outlook that can allow arbitrary code execution if a user opens a crafted Office file; Microsoft reports no prior public disclosure or evidence of active exploitation and rates exploitability as "unlikely," and has released patches in the August 2026 updates (including KB5002755 for Outlook 2016). Organizations should prioritize deploying the cumulative update for affected Outlook/Office versions and reinforce phishing awareness and attachment filtering while patching.