CVE-2026-123375
A NVD · · CVE-2026-123375
Admiralty grading (A–F · 1–6)
Source reliability
- A Completely reliable
- B Usually reliable
- C Fairly reliable
- D Not usually reliable
- E Unreliable
- F Cannot be judged
Information credibility
- 1 Confirmed
- 2 Probably true
- 3 Possibly true
- 4 Doubtful
- 5 Improbable
- 6 Cannot be judged
NATO Admiralty (AJP-2.1) grades confidence, independent of the risk score. Cross-source corroboration isn't tracked for non-CVE news, so single-source items are capped at a lower credibility number; a low number does not imply low quality.
Key metrics
- CVSS
- 8.8
- EPSS
- 0%
Key insight
The alert contains no indication of active exploitation, victim groups, or TTPs and therefore does not go beyond the CVE information itself.
Description
CVE-2026-123375 describes a stack-based buffer overflow in Microsoft Office Outlook that may allow an unauthorized attacker to execute code over the network. The alert provides no further details on the attack vector, required privileges, or user interaction. There is no information on active exploitation, KEV inclusion, or a public proof-of-concept. Outlook installations are affected if the vulnerable component is present; the alert does not provide patch or mitigation details.
Risk score
- cvss base
- 88.00
- kev bonus
- 0.00
- epss bonus
- 0.00
- poc bonus
- 0.00
- raw before weight
- 88.00
- industry weight
- 1.21
- freshness factor
- 1.00
- exploitability factor
- 1.00
- days old
- 0.00
- vendor mismatch penalty
- 0.00
Path: operational