Loading story…
Microsoft patched a critical Microsoft Office vulnerability, tracked as CVE-2025-30377, that can allow remote code execution when a specially crafted email attachment is processed in Outlook’s Preview Pane. The flaw was described as a use-after-free memory corruption issue tied to improper pointer management in Office, and exploitation reportedly requires little to no user interaction, making it effectively a zero-click threat during normal email handling.
Affected products reportedly included Microsoft 365 Apps, Office 2016 through Office 2024, and Office Online Server 2019 through 2025 before the May 2025 security updates. Security guidance urged organizations to deploy Microsoft’s patches quickly, consider temporarily disabling Outlook preview features, strengthen email filtering, and monitor for unusual Office process behavior, suspicious attachments, and anomalous email or authentication activity because successful exploitation could enable malware installation, credential theft, unauthorized access, and wider enterprise compromise.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Microsoft addressed CVE-2025-30377, a critical Microsoft Office remote code execution flaw exploitable via Outlook's Preview Pane, in its May 2025 Patch Tuesday updates. Affected products included Microsoft 365 Apps, Office 2016 through Office 2024, and Office Online Server versions 2019 through 2025 prior to the patch.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft has released fixes for multiple **critical Microsoft Office, Word, and Outlook Classic vulnerabilities** that can lead to remote code execution when a victim opens or previews a specially crafted file or email. The affected flaws include Office bugs **CVE-2025-49695**, **CVE-2025-49696**, **CVE-2025-49697**, **CVE-2025-49699**, **CVE-2025-49702**, Word bug **CVE-2025-49698**, and newer Outlook/Word rendering issues **CVE-2026-45456**, **CVE-2026-45458**, and **CVE-2026-47635**. Microsoft described the bugs as stemming from memory-safety issues such as **use-after-free**, **heap-based buffer overflow**, **type confusion**, and **out-of-bounds read**, with several carrying **CVSS 8.4** ratings. In multiple cases, Microsoft said the **Preview Pane** can trigger exploitation, and some flaws may be exploited without additional user interaction once malicious content is rendered. Microsoft said the vulnerable code paths affect Office and Word components, including the **Word rendering engine** used by **Outlook Classic**, and that supported builds such as **Microsoft Office LTSC 2024** and Mac Office LTSC channels received updates, with some Mac patches arriving later. Most of the 2025 flaws were not publicly disclosed or exploited at publication, though Microsoft assessed some as **more likely** to be exploited; the 2026 Outlook and Word issues similarly prompted urgent patching guidance because remotely delivered email content can trigger local processing and code execution. Microsoft urged organizations to install all applicable updates and strengthen defenses around Office email handling, including **Protected View**, **Attack Surface Reduction** rules, and monitoring for suspicious Office child-process activity.
Jun 29, 2026
Microsoft released March Patch Tuesday security updates addressing nearly 80 vulnerabilities, including critical Microsoft Office remote code execution issues that can be triggered via the Windows **Preview Pane**. TechRepublic highlighted two Office flaws—**CVE-2026-26113** and **CVE-2026-26110**—where simply previewing a malicious document can lead to attacker-controlled code execution, creating a low-friction initial access path for enterprise endpoints. Cybersecurity News provided additional technical detail on **CVE-2026-26110**, describing it as a **type confusion** bug (CWE-843) with a **CVSS 8.4** rating affecting Office across **Windows, macOS, and Android**. The write-up notes that while Microsoft labels it “remote code execution,” exploitation requires the payload to execute on the local machine (i.e., attacker code runs locally after the victim triggers the vulnerable processing), and emphasizes the risk that Preview Pane handling can enable compromise without the user opening the document in the traditional sense.
Jun 29, 2026
Microsoft released June 2026 security updates that include fixes for three critical remote code execution vulnerabilities in Outlook and Word: `CVE-2026-45456`, `CVE-2026-45458`, and `CVE-2026-47635`. The flaws were described as memory-safety issues in the Word rendering engine, which Outlook Classic uses to render email content, creating a **no-click** attack path through the Outlook Preview Pane. Microsoft assigned each issue a CVSS score of **8.4** and said no active exploitation had been observed at the time of disclosure. The vulnerabilities affect supported Microsoft Office and Outlook builds, including Office LTSC 2024, and were addressed as part of Microsoft’s June Patch Tuesday releases highlighted by multiple security advisories. Reporting on the updates urged organizations to prioritize patch deployment, especially for systems running Outlook Classic and Word, and to consider temporary risk reduction measures such as disabling the Preview Pane in high-risk environments while monitoring for suspicious Office-related process activity.
Jul 7, 2026