{"id":"CVE-2026-119993","aliases":[],"cve":{"records":[{"id":"CVE-2026-119993","source":"microsoft","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-30T17:58:13.877Z","published":"2026-11-10T18:25:06.709Z","modified":"2026-11-13T18:13:48.892Z"}],"publishers":[{"name":"microsoft","role":"CNA","organizationId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","modified":"2026-11-13T18:13:48.892Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-10T18:57:27.791Z"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119993","tags":["vendor-advisory","patch"],"source":"microsoft"}],"weaknesses":[{"id":"CWE-843","description":"CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')","source":"microsoft"},{"id":"CWE-822","description":"CWE-822: Untrusted Pointer Dereference","source":"microsoft"}],"applicability":[{"source":"microsoft","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:office_2021:*:*:*:*:long_term_servicing_channel:*:*:*","versionStartIncluding":"16.0.1","versionEndExcluding":"16.0.14334.21048"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:office_2024:*:*:*:*:long_term_servicing_channel:*:*:*","versionStartIncluding":"16.0.0","versionEndExcluding":"16.0.17932.21140"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:365_apps:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"16.0.1","versionEndExcluding":"https://aka.ms/OfficeSecurityReleases"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-10T18:48:26.370587Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Microsoft Office Outlook Information Disclosure Vulnerability","titleSource":"microsoft","descriptionSource":"microsoft","description":"Access of resource using incompatible type ('type confusion') in Microsoft Office Outlook allows an unauthorized attacker to disclose information over a network.","score":6.5,"severity":"medium","published":"2026-11-10T18:25:06.709Z","modified":"2026-11-13T18:13:48.892Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Microsoft","name":"Microsoft 365 Apps for Enterprise","platforms":["32-bit Systems","x64-based Systems"],"versions":[{"version":"16.0.1","status":"affected","lessThan":"https://aka.ms/OfficeSecurityReleases","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-119993"},{"vendor":"Microsoft","name":"Microsoft Office LTSC 2021","platforms":["32-bit Systems","x64-based Systems"],"versions":[{"version":"16.0.1","status":"affected","lessThan":"16.0.14334.21048","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-119993"},{"vendor":"Microsoft","name":"Microsoft Office LTSC 2024","platforms":["32-bit Systems","x64-based Systems"],"versions":[{"version":"16.0.0","status":"affected","lessThan":"16.0.17932.21140","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-119993"}],"remediation":[],"references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119993"],"sources":[{"name":"CVE","id":"CVE-2026-119993","modified":"2026-11-13T18:13:48.892Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-119993"}],"assessments":[{"source":"microsoft","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C","score":6.5}],"sourceAffected":[],"observedAt":"2026-11-13T19:19:37.472Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T01:10:30.655Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-11-10T19:10:40.423Z","attemptedAt":"2026-11-10T19:10:40.423Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-10T19:10:40.977Z","attemptedAt":"2026-11-10T19:10:40.977Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-10T19:10:42.076Z","attemptedAt":"2026-11-10T19:10:42.076Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-10T19:10:43.871Z","attemptedAt":"2026-11-10T19:10:43.871Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-122603","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-122603","modified":"Nov 10, 2026, 6:25:06 PM","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C","checkedAt":"2026-11-10T19:10:42.076Z"}],"aiSummary":{"text":"Microsoft Office Outlook has a vulnerability allowing unauthorized information disclosure over a network due to 'type confusion'. It affects versions 16.0.1 of Microsoft 365 Apps for Enterprise and Microsoft Office LTSC 2021, as well as version 16.0.0 of Microsoft Office LTSC 2024. An attacker needs network access to exploit this weakness.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-10T18:56:10.234Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-119993"}]}}