Microsoft Office Preview Pane Remote Code Execution — CVE-2026-26110 (Type Confusion) & CVE-2026-26113 (Untrusted Pointer Dereference)

Microsoft Office Preview Pane Remote Code Execution (TL-2026-0209) is a critical-severity software vulnerability scored CVSS 8.4, first published 2026-03-11. It has no confirmed attribution, affects Microsoft Microsoft Office 2016, references 2 CVEs (CVE-2026-26110, CVE-2026-26113), maps to 16 MITRE ATT&CK techniques (T1003, T1005, T1027), and is covered by 9 detection rules and 15 indicators of compromise.

Key facts for TL-2026-0209

Threat ID
TL-2026-0209
Severity
CRITICAL
CVSS
8.4 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N)
Status
PATCHED
Category
VULNERABILITY
First published
2026-03-11
Last reviewed
2026-03-11
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
government, financial, healthcare, education, technology, defense, energy, manufacturing, legal, media
Target regions
Global
Detection rules
9
Indicators of compromise
15

Malware and tooling in Microsoft Office Preview Pane Remote Code Execution

Malware and tooling: Snort SIDs 66089-66092, 66096-66097, 66101-66104 (Snort 2); 301442-301446 (Snort 3)

Two critical remote code execution vulnerabilities in Microsoft Office (CVE-2026-26110, CVE-2026-26113) exploitable via the Outlook Preview Pane without user interaction. CVE-2026-26110 is a type confusion flaw and CVE-2026-26113 is an untrusted pointer dereference, both allowing unauthenticated attackers to execute arbitrary code by sending a crafted Office document that triggers on preview.

How Microsoft Office Preview Pane Remote Code Execution works

Microsoft's March 2026 Patch Tuesday addressed two critical remote code execution vulnerabilities in Microsoft Office that share the Preview Pane as a common attack vector, creating a near zero-click exploitation scenario.

CVE-2026-26110 is a type confusion vulnerability (CWE-843) in Microsoft Office caused by improper handling of incompatible data types during resource access. When a specially crafted Office document is rendered in the Preview Pane, the application incorrectly interprets a data structure as a different type, leading to memory corruption and arbitrary code execution with the privileges of the logged-in user.

CVE-2026-26113 is an untrusted pointer dereference vulnerability (CWE-822) in Microsoft Office where the application improperly handles memory pointers during document rendering. An attacker can craft a malicious Office document that manipulates how the application accesses memory, allowing arbitrary pointer dereference and subsequent code execution.

Both vulnerabilities share critical characteristics: low attack complexity, no privileges required, no user interaction needed, and the Preview Pane as an attack vector. The exploitation chain begins when a victim receives a malicious Office document — typically via email — and the Outlook Preview Pane automatically renders it. The rendering process triggers either the type confusion or pointer dereference flaw, granting the attacker code execution on the target system.

Although Microsoft classifies these as remote code execution vulnerabilities, the CVSS attack vector is Local (AV:L) because the exploit code ultimately executes on the local device. The remote delivery mechanism (email) serves as the initial access vector, while exploitation occurs during local document parsing.

Microsoft assessed exploitation as 'Less Likely' at the time of release, and neither vulnerability was publicly disclosed or observed in active attacks. However, the Preview Pane attack surface has historically been a high-value target for threat actors, and security researchers at the Zero Day Initiative noted these follow a recurring pattern of Office Preview Pane vulnerabilities that are 'just a matter of time' before appearing in active exploits.

Cisco Talos released Snort rules (IDs 66089-66092, 66096, 66097, 66101-66104 for Snort 2; 301442-301446 for Snort 3) to detect exploitation attempts. Affected products include Microsoft Office 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise.

The critical risk factor is the near zero-click nature of the attack: organizations with the Outlook Preview Pane enabled (the default configuration) are vulnerable to exploitation without any user action beyond receiving a malicious email. This makes these vulnerabilities particularly dangerous for enterprise environments where Office is universally deployed.

---

**Revalidated on 2026-03-12**

REVALIDATION NOTE (2026-03-12): Core description remains accurate and comprehensive. Two clarifications warranted: (1) CVSS Score Variance — The advisory uses CVSS 8.4 consistent with MSRC's assessment. Some third-party sources report 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H per some analyses) or even 9.8. The discrepancy stems from how the attack vector is scored — MSRC uses AV:L because exploitation executes locally during document parsing, while some analysts use AV:N because the delivery mechanism is network-based (email). The AV:L/8.4 score used in the advisory follows MSRC's authoritative assessment and is technically correct for the exploitation step itself. (2) Zero-Day Clarification — CyberScoop confirms this March Patch Tuesday is the first in six months with NO actively exploited zero-days. The two publicly disclosed zero-days are CVE-2026-21262 (SQL Server privilege escalation) and CVE-2026-26127 (.NET DoS) — NOT CVE-2026-26110/26113. This further validates the 'THEORETICAL' exploitability rating and 'exploitation-less-likely' tag. (3) Help Net Security reports six CVEs flagged as 'more likely' to be exploited, all involving privilege escalation — CVE-2026-26110 and CVE-2026-26113 are explicitly NOT among them.

MITRE ATT&CK techniques used in TL-2026-0209

credential-access

T1003 OS Credential Dumping

collection

T1005 Data from Local System

defense-evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection

exfiltration

T1041 Exfiltration Over C2 Channel

discovery

T1057 Process Discovery; T1082 System Information Discovery

execution

T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution; T1204 User Execution

privilege-escalation

T1068 Exploitation for Privilege Escalation

command-and-control

T1071 Application Layer Protocol

persistence

T1547 Boot or Logon Autostart Execution

impact

T1565 Data Manipulation

initial-access

T1566 Phishing

Affected products and versions in Microsoft Office Preview Pane Remote Code Execution

  • Microsoft — Microsoft Office 2016
    Vulnerable versions: All builds prior to March 2026 patch
    Fixed in: March 2026 Security Update
  • Microsoft — Microsoft Office 2019
    Vulnerable versions: All builds prior to March 2026 patch
    Fixed in: March 2026 Security Update
  • Microsoft — Microsoft Office LTSC 2021
    Vulnerable versions: All builds prior to March 2026 patch
    Fixed in: March 2026 Security Update
  • Microsoft — Microsoft Office LTSC 2024
    Vulnerable versions: All builds prior to March 2026 patch
    Fixed in: March 2026 Security Update
  • Microsoft — Microsoft 365 Apps for Enterprise
    Vulnerable versions: All builds prior to March 2026 patch
    Fixed in: March 2026 Security Update

Remediation for Microsoft Office Preview Pane Remote Code Execution

Patches

  • Microsoft March 2026 Patch Tuesday — Security Update for Microsoft Office (CVE-2026-26110)
  • Microsoft March 2026 Patch Tuesday — Security Update for Microsoft Office (CVE-2026-26113)
  • Apply updates via Windows Update, Microsoft Update Catalog, WSUS, or Configuration Manager

Immediate actions

  • Apply March 2026 Patch Tuesday security updates for all Microsoft Office installations immediately
  • Disable the Outlook Preview Pane across the organization via Group Policy (Outlook > Reading Pane > Off)
  • Disable Windows Explorer Preview Pane for Office file types
  • Block Office file attachments from untrusted external senders at the email gateway
  • Enable Attack Surface Reduction (ASR) rules for Office applications

Workarounds

  • Disable Outlook Preview Pane: View > Reading Pane > Off
  • Disable Windows Explorer Preview Pane for Office documents
  • Restrict opening Office files from untrusted sources
  • Configure Office to open documents in Protected View by default

Longer-term hardening

  • Deploy EDR with behavioral detection for anomalous Office process activity
  • Implement application whitelisting to prevent unauthorized child process spawning from Office applications
  • Configure Microsoft Defender Application Guard for Office to isolate untrusted documents
  • Establish automated patch management for Office products with SLA of 48 hours for critical vulnerabilities
  • Enable Protected View for all Office documents from external sources

CVEs associated with Microsoft Office Preview Pane Remote Code Execution

CVE-2026-26110, CVE-2026-26113

Weaknesses (CWE) in Microsoft Office Preview Pane Remote Code Execution

CWE-843, CWE-822

Timeline of Microsoft Office Preview Pane Remote Code Execution

  • Microsoft assesses exploitation as Less Likely; no public disclosure or active exploitation observed at time of release. ZDI warns Preview Pane vulnerabilities historically progress to active exploitation
  • Cisco Talos releases Snort detection rules (IDs 66089-66092, 66096, 66097, 66101-66104 for Snort 2; 301442-301446 for Snort 3) covering exploitation attempts
  • CrowdStrike, Zero Day Initiative, Cisco Talos, Tenable, and Qualys publish detailed Patch Tuesday analysis identifying Preview Pane as attack vector for both CVEs
  • Microsoft Security Response Center publishes advisories for CVE-2026-26110 (type confusion) and CVE-2026-26113 (untrusted pointer dereference) rated Critical with CVSS 8.4
  • Microsoft releases March 2026 Patch Tuesday security updates fixing CVE-2026-26110 and CVE-2026-26113 among 79+ other vulnerabilities
  • CyberScoop reports March 2026 Patch Tuesday is the first in six months with no actively exploited zero-days, confirming theoretical-only exploitation status for CVE-2026-26110 and CVE-2026-26113
  • Multiple security vendors (Dark Reading, SecurityWeek, Help Net Security, Dataconomy) publish independent analyses confirming CVE-2026-26110 and CVE-2026-26113 as critical Office Preview Pane RCE vulnerabilities with no observed active exploitation
  • Threadlinqs Intelligence Platform publishes TL-2026-0209 threat advisory with full MITRE ATT&CK mapping, detection coverage, and remediation guidance
  • Threadlinqs Intelligence revalidation: all core claims verified against 14+ independent sources. No public PoC, no CISA KEV listing, no confirmed active exploitation. CVSS score variance noted (8.4 MSRC vs. 8.8/9.8 in some third-party reports).
  • As of 2026-05-29, CVE-2026-26110/26113 (Office Preview Pane RCE) remain fully patched via Microsoft's March 2026 update with no active exploitation, no public PoC, and no CISA KEV listing (confirmed against NVD and the May 20/27 KEV additions). Microsoft rated exploitation "Less Likely"; PATCHED status is unchanged and no successor threat exists.

Sources cited for Microsoft Office Preview Pane Remote Code Execution

Threats related to Microsoft Office Preview Pane Remote Code Execution

Detection coverage for TL-2026-0209

As of 2026-03-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0209 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats