CVE-2018-0852: Microsoft Outlook 2007 SP3, Microsoft Outlook 2010 SP2, Microsoft Outlook 2013 SP1 and RT SP1, Microsoft Ou...

Security readout for executives and security teams

This is a remote code execution issue in Microsoft Outlook and Office 2016 Click-to-Run caused by Outlook mishandling objects in memory. If an organization still runs the listed legacy Outlook versions, successful exploitation could let an attacker run code in the user context. The provided sources do not include CVSS, named fixes, or active exploitation evidence. Exposure is most likely in environments retaining legacy Microsoft Outlook clients or Office 2016 Click-to-Run installations. Modern Microsoft 365 Apps may be unaffected, but the provided bundle does not define fixed versions, update KBs, or platform exclusions. Treat asset inventory accuracy as the first control point. Prioritize if legacy Outlook is still in production, especially for executives, finance, legal, and administrators. Remote code execution in email clients can create direct business risk, but urgency depends on whether affected versions remain deployed. No active exploitation is evidenced in the provided sources. Mitigation focus: Review the Microsoft MSRC advisory for vendor-confirmed updates and guidance.; Patch or retire affected Outlook and Office versions where present.; Prioritize remediation for internet-facing email users and high-privilege workstations..

Prepared

Jun 7, 2026, 14:40 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.