Use-After-Free RCE in Microsoft Office Outlook

Successful exploitation allows an unauthorized attacker to execute arbitrary code locally in the security context of the user running Outlook. Depending on that user’s privileges, this can enable full compromise of the workstation, access to user data, installation of malware, and follow-on activity such as persistence or lateral movement.

Until patches are fully deployed, reduce exposure by limiting the ability of users to interact with untrusted email, especially replying to unsolicited or suspicious messages. Use email security controls to filter malicious messages and attachments, enforce least privilege for end users, and monitor for suspicious Outlook child-process or post-email-interaction execution behavior. The provided content specifically indicates that the Preview Pane is not an attack vector for this vulnerability, so mitigations should focus on preventing user interaction with attacker-supplied emails rather than disabling preview alone.

Apply the Microsoft security update for CVE-2025-62562 released as part of the December 2025 security updates for affected Microsoft Office Outlook installations. Prioritize patching Outlook deployments and any affected enterprise environments identified by Microsoft’s advisories. Standard patch validation and enterprise rollout procedures should be followed.