Assessment
Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
- Severity
- Important
- CVSS base score
- 7.5
- Impact
- Remote Code Execution
- Exploitation detected
- No known exploitation (MSRC assessment)
- Exploitability
- Exploitation Less Likely
- Publicly disclosed
- No (MSRC assessment)
- EPSS · 30-day forecast
- 0.5%FIRST forecast dated 10 Nov 2026, for the following 30 days · FIRST percentile 39.5% · about EPSS
- Customer action
- Required: follow the MSRC remediation guidance
More details
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
- Public detection template
- No Nuclei template is listed in the current collected catalog
- Component
- Microsoft Office Outlook
- Weakness
- CWE-190: Integer Overflow or Wraparound
- Issued by
- Microsoft
- Last revised
- 25 Sep 2026
CVSS 3.1 base metricsRed raises the risk · green lowers it
- Attack vector
- NetworkAV:N
- Attack complexity
- HighAC:H
- Privileges required
- NonePR:N
- User interaction
- RequiredUI:R
- Scope
- UnchangedS:U
- Confidentiality
- HighC:H
- Integrity
- HighI:H
- Availability
- HighA:H
Updates that fix it
0 KBsNo KB listed
No KB update is listed in the collected MSRC record. Check the MSRC advisory for product releases and other remedies.
What changed
Detection template: Unknown: detection-template evidence is incomplete or retained → No Nuclei template listed
Detection template: No Nuclei template listed → Unknown: detection-template evidence is incomplete or retained
Page history
Changes are dated when recorded; day views use the last saved version from that UTC day, and citations stay fixed.
Cite this versionField-level log (16)
Up to 100 recent field edits are shown; older edits may be outside retention.
- 10 Nov 2026 · 18:32:11 UTC
EPSS0.5%; scored 9 Nov 2026 → 0.5%; scored 10 Nov 2026
- 9 Nov 2026 · 22:24:37 UTC
EPSS0.5%; scored 8 Nov 2026 → 0.5%; scored 9 Nov 2026
- 8 Nov 2026 · 15:16:05 UTC
EPSS0.5%; scored 7 Nov 2026 → 0.5%; scored 8 Nov 2026
- 7 Nov 2026 · 16:12:44 UTC
EPSS0.5%; scored 6 Nov 2026 → 0.5%; scored 7 Nov 2026
- 6 Nov 2026 · 19:15:37 UTC
EPSS0.5%; scored 5 Nov 2026 → 0.5%; scored 6 Nov 2026
- 6 Nov 2026 · 17:32:22 UTC
Public detection templateUnknown: detection-template evidence is incomplete or retained → No Nuclei template listed
- 6 Nov 2026 · 17:32:22 UTC
Source coverage: public-exploit-codeIncomplete → Current
- 6 Nov 2026 · 17:32:22 UTC
Source coverage: first-epssIncomplete → Current
- 6 Nov 2026 · 17:32:22 UTC
Source coverage: msrc-cvrfIncomplete → Current
- 6 Nov 2026 · 16:31:02 UTC
Public detection templateNo Nuclei template listed → Unknown: detection-template evidence is incomplete or retained
- 6 Nov 2026 · 16:31:02 UTC
Source coverage: public-exploit-codeCurrent → Incomplete
- 6 Nov 2026 · 16:31:02 UTC
Source coverage: first-epssCurrent → Incomplete
- 6 Nov 2026 · 16:31:02 UTC
Source coverage: msrc-cvrfCurrent → Incomplete
- 5 Nov 2026 · 23:42:03 UTC
EPSS0.5%; scored 4 Nov 2026 → 0.5%; scored 5 Nov 2026
- 5 Nov 2026 · 02:36:20 UTC
EPSS0.5%; scored 3 Nov 2026 → 0.5%; scored 4 Nov 2026
- 4 Nov 2026 · 03:04:37 UTC
EPSS0.5%; scored 2 Nov 2026 → 0.5%; scored 3 Nov 2026
Explore global source statements, affected packages and advisory history for CVE-2026-100208. The catalog has a separate collection scope from Microsoft release records.
cve-program · CVE-2026-100208
PublishedMicrosoft 365 Apps for Enterprise
Vendor product
Original vendor version evidence · not evaluated as a NuGet range
{
"vendor": "Microsoft",
"product": "Microsoft 365 Apps for Enterprise",
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"versions": [
{
"version": "16.0.1",
"lessThan": "https://aka.ms/OfficeSecurityReleases",
"versionType": "custom",
"status": "affected"
}
]
}Microsoft Office LTSC 2021
Vendor product
Original vendor version evidence · not evaluated as a NuGet range
{
"vendor": "Microsoft",
"product": "Microsoft Office LTSC 2021",
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"versions": [
{
"version": "16.0.1",
"lessThan": "https://aka.ms/OfficeSecurityReleases",
"versionType": "custom",
"status": "affected"
}
]
}Microsoft Office LTSC 2024
Vendor product
Original vendor version evidence · not evaluated as a NuGet range
{
"vendor": "Microsoft",
"product": "Microsoft Office LTSC 2024",
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"versions": [
{
"version": "16.0.0",
"lessThan": "https://aka.ms/OfficeSecurityReleases",
"versionType": "custom",
"status": "affected"
}
]
}Original source record · Cite this exact observation · Complete original publisher JSON