Quick answers
- Is CVE-2026-80084 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-80084 being exploited in the wild.
- How severe is CVE-2026-80084?
- Medium severity, with a CVSS score of 6.5, published 8 September 2026.
- Which products and versions are affected?
- Microsoft Outlook.
- Is there a fix for CVE-2026-80084?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-80084 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-80084?
- Check whether you run Microsoft Outlook. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This vulnerability is an out-of-bounds read in Microsoft Outlook's message parsing logic. The affected component fails to properly validate buffer boundaries when processing specially crafted messages, allowing an attacker to read memory beyond the intended buffer. The attack requires network connectivity to deliver a malicious message but does not require user authentication or interaction. A successful exploit permits an attacker to disclose sensitive information resident in Outlook's memory or accessible through the application's context.
Affected products
- Microsoft Outlook
Timeline
- 2026-09-08: disclosed