Microsoft Outlook Flaw CVE-2026-100208 Could Allow Remote Code Execution

An integer overflow vulnerability in Microsoft Office Outlook could allow remote code execution, letting an unauthorized attacker run code over a network. NVD published the record, CVE-2026-100208, on September 25.

Microsoft scores the Outlook bug 7.5, rated High. The CVSS 3.1 score comes from Microsoft as the CNA that assigned the CVE. Its vector says an attack works over the network without any privileges, but it needs the victim to interact and is rated high in complexity.

The root cause is an integer overflow or wraparound. NVD files the weakness under CWE-190. If an attack succeeds, the vector rates the impact on confidentiality, integrity and availability as high.

Microsoft's Security Update Guide holds the vendor entry. The NVD record links to Microsoft's page for CVE-2026-100208. The record does not name affected Outlook versions or a fix, and it says nothing about exploitation. NVD has not finished its own analysis of the entry.