Microsoft’s advisory assigns the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C. The supplied advisory record also states that user interaction is required: an attacker must send a malicious Office file and convince the recipient to open it. Customer action required: Yes.
Microsoft’s exploitation assessment is Exploitation Unlikely. Publicly disclosed: No. Exploited: No. Those assessments should influence prioritization, but they do not remove the need to update Outlook clients: successful exploitation can affect confidentiality, integrity, and availability, as reflected in the high impact metrics in the CVSS vector.
A malformed Office file is the delivery mechanism
Microsoft describes CVE-2026-70329 as an integer overflow or wraparound in Microsoft Office Outlook that allows an unauthorized attacker to execute code over a network. Integer-overflow flaws occur when a calculation exceeds the range the software expects, potentially causing Outlook to allocate, copy, or interpret data incorrectly.
The prerequisite is significant for email-security operations. Microsoft says an attacker must convince a user to open a malicious Office file, so the vulnerable action is not merely receiving an email in an inbox. Organizations should still treat this as a realistic phishing risk: Outlook is commonly used to receive and open the attachments that attackers use for initial access.
The advisory’s plain-language explanation also calls the attack local, saying that code must be executed from the local machine to exploit the vulnerability. That creates a notable documentation mismatch: the CVSS vector supplied for the CVE begins with AV:N, while Microsoft’s advisory explanation refers to AV:L. Microsoft further explains that “Remote” in the title refers to the attacker’s location, and calls this category of issue Arbitrary Code Execution, or ACE. Administrators should use the user-interaction requirement—not the title alone—when deciding where to accelerate deployment and phishing defenses.
Office servicing branches require different verification
The affected list spans subscription-based Microsoft 365 Apps for Enterprise, perpetual Office 2019, Office LTSC 2021, Office LTSC 2024, and standalone Outlook 2016. This is operationally important because the Microsoft 365 and LTSC products are remediated through the Office security-release servicing path, whereas Outlook 2016 has an explicit KB and a numeric target build.
For Microsoft 365 Apps for Enterprise for 32-bit Systems (x86), update to fixed build Release notes for Microsoft Office security updates - Office release notes | Microsoft Learn or later.
For Microsoft 365 Apps for Enterprise for 64-bit Systems (x64), update to fixed build Release notes for Microsoft Office security updates - Office release notes | Microsoft Learn or later.
For Microsoft Office 2019 for 32-bit editions (x86), update to fixed build Release notes for Microsoft Office security updates - Office release notes | Microsoft Learn or later.
For Microsoft Office 2019 for 64-bit editions (x64), update to fixed build Release notes for Microsoft Office security updates - Office release notes | Microsoft Learn or later.
For Microsoft Office LTSC 2021 for 32-bit editions (x86), update to fixed build Release notes for Microsoft Office security updates - Office release notes | Microsoft Learn or later.
For Microsoft Office LTSC 2021 for 64-bit editions (x64), update to fixed build Release notes for Microsoft Office security updates - Office release notes | Microsoft Learn or later.
For Microsoft Office LTSC 2024 for 32-bit editions (x86), update to fixed build Release notes for Microsoft Office security updates - Office release notes | Microsoft Learn or later.
For Microsoft Office LTSC 2024 for 64-bit editions (x64), update to fixed build Release notes for Microsoft Office security updates - Office release notes | Microsoft Learn or later.
For Microsoft Outlook 2016 (32-bit edition) (x86), install KB5002755 to reach fixed build 16.0.5565.1000.
For Microsoft Outlook 2016 (64-bit edition) (x64), install KB5002755 to reach fixed build 16.0.5565.1000.
The KB-to-build record
The fixed-version data provides a clear distinction between product families. Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021, and Office LTSC 2024 are mapped to the Office security-release fixed-build reference rather than a numbered KB in the supplied record. Outlook 2016, in both 32-bit and 64-bit editions, is mapped specifically to KB5002755 and fixed build 16.0.5565.1000.
That means patch validation should be based on the servicing method actually used in the environment. Teams managing Click-to-Run Office installations should confirm that deployed clients have reached the applicable fixed Office security release. Teams retaining Outlook 2016 should verify both that KB5002755 is installed and that the client reports version 16.0.5565.1000.
Patch deployment should focus on attachment-opening users
CVE-2026-70329 is a client-side code-execution issue with no attacker privileges required under the supplied CVSS vector, but it does require a person to open the malicious file. Security teams should prioritize systems used by executives, finance staff, help desks, administrators, and other users regularly targeted with convincing attachment-based phishing.
For managed Windows fleets, the immediate task is to identify installed Outlook and Office products by edition and architecture, deploy the matching update path, and verify the post-update version rather than treating a completed software-distribution job as proof of remediation. Mail filtering, attachment inspection, and user reporting procedures remain useful compensating controls during rollout, but they do not replace the Microsoft fix.
Microsoft’s advisory identifies a fix for every affected product listed in the record. The concrete completion point is reaching the Office security-release fixed build for Microsoft 365 Apps for Enterprise, Office 2019, and Office LTSC installations, or reaching build 16.0.5565.1000 through KB5002755 for Outlook 2016.
