Microsoft's CVE record (published 23 September 2026) lists CVE-2026-70125 as a Microsoft Office Outlook Remote Code Execution Vulnerability: a heap-based buffer overflow in Microsoft Office Outlook that allows an unauthorized attacker to execute code locally. Microsoft CVSS 3.1 base 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C). Affected product lines named in the record: Microsoft 365 Apps for Enterprise; Microsoft Office LTSC 2021; Microsoft Office LTSC 2024 (version ranges point to Office security releases via aka.ms/OfficeSecurityReleases).

The record's temporal score marks exploit code maturity as Unproven, and CISA's enrichment in the record lists exploitation as 'none'.

Apply current Office/Outlook security updates from the MSRC update guide; do not invent build numbers beyond the vendor release channel. (source: CVE-2026-70125 record (cve.org))

Correction (31 Oct 2026): the card said Microsoft scored the flaw CVSS 3.1 8.8 with a network attack vector (AV:N). Microsoft's CVE record, updated 30 October 2026 at 21:57 UTC (5:57 am Perth, 31 October), now scores it 7.8 with a local attack vector (AV:L) and describes a heap-based buffer overflow that lets an unauthorized attacker execute code locally; the title, score and vector now follow the record. (source: CVE-2026-70125 record (cve.org))