Microsoft Patches Critical Office and Outlook Preview Pane RCE Flaws

Microsoft has released fixes for multiple critical Microsoft Office, Word, and Outlook Classic vulnerabilities that can lead to remote code execution when a victim opens or previews a specially crafted file or email. The affected flaws include Office bugs CVE-2025-49695, CVE-2025-49696, CVE-2025-49697, CVE-2025-49699, CVE-2025-49702, Word bug CVE-2025-49698, and newer Outlook/Word rendering issues CVE-2026-45456, CVE-2026-45458, and CVE-2026-47635. Microsoft described the bugs as stemming from memory-safety issues such as use-after-free, heap-based buffer overflow, type confusion, and out-of-bounds read, with several carrying CVSS 8.4 ratings. In multiple cases, Microsoft said the Preview Pane can trigger exploitation, and some flaws may be exploited without additional user interaction once malicious content is rendered.

Microsoft said the vulnerable code paths affect Office and Word components, including the Word rendering engine used by Outlook Classic, and that supported builds such as Microsoft Office LTSC 2024 and Mac Office LTSC channels received updates, with some Mac patches arriving later. Most of the 2025 flaws were not publicly disclosed or exploited at publication, though Microsoft assessed some as more likely to be exploited; the 2026 Outlook and Word issues similarly prompted urgent patching guidance because remotely delivered email content can trigger local processing and code execution. Microsoft urged organizations to install all applicable updates and strengthen defenses around Office email handling, including Protected View, Attack Surface Reduction rules, and monitoring for suspicious Office child-process activity.