{"id":"CVE-2026-97749","published":"2026-10-13T19:22:12.340","lastModified":"2026-10-15T16:15:12.760","description":"Double free in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-415"],"vendors":["microsoft"],"products":["365 apps","office 2021","office 2024"],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97749","tags":["Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Microsoft Outlook contains a double free vulnerability that allows remote attackers to execute arbitrary code on affected systems. This flaw occurs when the application improperly handles memory deallocation, creating opportunities for attackers to corrupt memory and gain control over the application's execution flow.","exploitability":"Exploitation is moderately difficult as it requires a remote attacker to craft a malicious Office document that triggers the double free condition, but once triggered, the vulnerability can be exploited without user interaction.","blast_radius":"The impact could be significant as Outlook is widely used across organizations, and successful exploitation could allow attackers to execute code on user workstations with the privileges of the Outlook process, potentially leading to full system compromise.","remediation":"Deploy the Microsoft Office update KB5042738 or later to address this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","office","memory-corruption"],"model":"garnet-coder","analyzedAt":"2026-10-14T08:52:06.271Z"}}