important · Zero-click — Email
A crafted email rendered in Outlook’s Reading Pane can execute code without a click.
Affects
Microsoft Outlook and related Office installations on Windows and macOS, including Microsoft 365 Apps and perpetual Office releases.
Outlook automatically processes the message in its Reading Pane, where a heap-based buffer overflow can produce code execution with the logged-on user’s privileges.
Detail and 5 sources
Microsoft published affected and fixed build ranges. Fix coverage reaches end-of-life hardware, but pre-fix image acceptance and revocation completeness remain unresolved.
Sources
ResearchSecurity Update Guide - Microsoft Security Response CenterResearchCVE-2026-78509 - Vulnerability-LookupResearchSeptember 2026 Patch Tuesday: Updates and Analysis | CrowdStrikeResearchPatch Tuesday September 2026: CVE Analysis | AutomoxResearchZero Day Initiative — The September 2026 Security Update Review