CVE-2026-80073: Microsoft Office Outlook Information Disclosure Vulnerability

Microsoft assesses exploitation as less likely and reports no exploitation, but the Preview Pane’s inclusion as an attack vector gives this patch practical urgency for organizations that receive untrusted email. The remediation is straightforward: bring each affected Office or Outlook installation to its specified fixed build, or install the designated Outlook 2016 update.

CVE-2026-80073 fixes an Outlook out-of-bounds read​

CVE-2026-80073 is titled Microsoft Office Outlook Information Disclosure Vulnerability. Microsoft rates it Important, with a CVSS base score of 6.5 and a temporal score of 5.7.

The full CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C. The weakness is classified as CWE-125, an out-of-bounds read: software accesses memory outside the intended bounds of a buffer or data structure.

Microsoft describes the flaw as follows: “Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker to disclose information over a network.” A successful attacker could potentially read small portions of heap memory, according to the company’s advisory. Heap memory is working memory allocated while an application is running, so the disclosed data can depend on what Outlook is processing at the time.

Microsoft’s advisory explicitly answers a key operational question: “Is the Preview Pane an attack vector for this vulnerability? Yes, the Preview Pane is an attack vector.” That makes timely client updating more valuable than relying on a workflow in which users avoid opening suspicious messages.

Publicly disclosed: No

Exploited: No

Customer action required: Yes

Microsoft’s exploitation assessment is Exploitation Less Likely. That assessment describes the vendor’s current view of exploitability; it does not remove the need to deploy the supplied fixes on affected clients.

Microsoft 365 Apps and perpetual Office have different fixed builds​

The affected scope spans subscription Microsoft 365 Apps, perpetual Office 2019, Office LTSC 2021, Office LTSC 2024, and Outlook 2016. Both 32-bit and 64-bit editions are included for every listed product family.

For Microsoft 365 Apps for Enterprise, Microsoft sets the same fixed build for both architectures:

Office 2019 uses a separate fixed build:

The LTSC releases likewise have their own version thresholds. Administrators should treat these as product-specific requirements rather than assuming that a build number suitable for Microsoft 365 Apps also applies to a perpetual Office deployment.

Outlook 2016 requires KB5002919 and build 16.0.5569.1000​

Outlook 2016 has a distinct remediation path. Rather than a Microsoft 365 Apps or Office LTSC build target, both affected Outlook 2016 editions require a named knowledge-base update.

The distinction matters for patch verification. An administrator auditing Outlook 2016 should look for KB5002919 and confirm fixed build 16.0.5569.1000, while an administrator auditing Microsoft 365 Apps, Office 2019, or either LTSC release should compare the installed build with the appropriate product-family threshold above.

The Preview Pane makes endpoint patching the central control​

The advisory’s Preview Pane finding changes the risk conversation from “do users open attachments?” to “are Outlook clients updated?” Microsoft identifies user interaction in the CVSS vector, but it also confirms that displaying message content in the Preview Pane can provide the attack path.

The documented impact is information disclosure, specifically the potential exposure of small portions of heap memory. Microsoft’s CVSS vector assigns High confidentiality impact (C:H) and no integrity or availability impact (I:N/A:N). In practical terms, this is a patching and exposure-management issue, not a stated mechanism for modifying data or taking Outlook offline.

Organizations that operate several Office servicing models should inventory them separately. A machine with Microsoft 365 Apps for Enterprise needs build 16.0.20326.20138 or later; an Office LTSC 2021 device needs 16.0.14334.20906 or later. Collapsing those populations into one generic “Office updated” report can conceal a device that remains below its own required fixed version.

What this means for you​

Deploy the applicable update now, prioritizing Outlook endpoints that handle external or untrusted email and verifying the result against the precise product and architecture installed.

• Microsoft lists CVE-2026-80073 as an Important information disclosure vulnerability with a CVSS base score of 6.5 and CVSS temporal score of 5.7.
• The flaw is CWE-125, an out-of-bounds read in Microsoft Office Outlook that can allow an unauthorized attacker to disclose information over a network.
• The Preview Pane is an attack vector, and Microsoft says successful exploitation could potentially expose small portions of heap memory.
• Microsoft 365 Apps for Enterprise for 32-bit Systems (x86) and Microsoft 365 Apps for Enterprise for 64-bit Systems (x64) must reach fixed build 16.0.20326.20138 or later.
• Microsoft Office 2019, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024 each have separate fixed-build requirements that should be checked by product and architecture.
• Microsoft Outlook 2016 (32-bit edition) (x86) and Microsoft Outlook 2016 (64-bit edition) (x64) require KB5002919 to reach fixed build 16.0.5569.1000.

CVE-2026-80073 is a conventional Outlook client-patching task with unusually clear operational relevance: Microsoft has identified a Preview Pane attack path and supplied exact build targets for every affected product in its advisory. The useful next step is not a broad Office update claim, but a version-specific check that confirms each Outlook deployment has reached its designated fixed build.