{"@odata.context":"https://api.msrc.microsoft.com/sug/v2.0/sugodata/v2.0/en-US/$metadata#vulnerability/$entity","id":"00000000-0000-0000-0000-0000d8ef40a1","releaseDate":"2026-10-13T07:00:00-07:00","cveNumber":"CVE-2026-97749","cveTitle":"Microsoft Office Outlook Remote Code Execution Vulnerability","releaseNumber":"2026-Oct","vulnType":"Security Vulnerability","latestRevisionDate":"2026-10-13T07:00:00-07:00","description":"<p>Double free in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.</p>\n","cweList":["CWE-415: Double Free"],"cweDetailsListForSearch":["cwe: CWE-415: Double Free","cweUrl: https://cwe.mitre.org/data/definitions/415.html"],"unformattedDescription":"<p>Double free in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.</p>","mitreText":"CVE-2026-97749","mitreUrl":"https://www.cve.org/CVERecord?id=CVE-2026-97749","publiclyDisclosed":"No","exploited":"No","latestSoftwareReleaseId":2,"latestSoftwareRelease":"Exploitation Less Likely","olderSoftwareReleaseId":0,"denialOfService":"N/A","tag":"Microsoft Office Outlook","issuingCna":"Microsoft","issuingCnaId":100000001,"severityId":100000000,"severity":"Critical","impactId":100000005,"impact":"Remote Code Execution","langCode":"en-US","baseScore":"9.8","temporalScore":"8.5","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","vectorStringSource":"Microsoft","isMariner":false,"customerActionRequired":true,"customerActionRequiredId":1,"cweDetailsList":[{"keys":["cwe","cweUrl"],"values":["CWE-415: Double Free","https://cwe.mitre.org/data/definitions/415.html"]}],"articles":[{"articleType":"FAQ","description":"<p><strong>How could an attacker exploit this vulnerability?</strong></p>\n<p>An attacker could send a specially crafted email message to a target user. Simply viewing the message in the Outlook Reading Pane could trigger the vulnerability, without the recipient opening the message or clicking anything in it. Successful exploitation could allow the attacker to execute code on the recipient's system. Network access is required; authentication and user interaction are not required.</p>\n","ordinal":10000},{"title":"Microsoft Office Outlook Remote Code Execution Vulnerability","articleType":"100000000","description":"<p>Double free in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.</p>\n","ordinal":10000}],"revisions":[{"cveNumber":"CVE-2026-97749","version":1,"revisionDate":"2026-10-13T07:00:00-07:00","initialDate":"0001-01-01T00:00:00Z","description":"<p>Information published.</p>\n","unformattedDescription":"Information published.","notificationNeeded":false,"notificationSent":false,"sourceId":"fbcc955c-5eb8-f111-93a1-000d3ac5fb71"}]}