Outlook About dialog: two-minute Office build check for CVE-2026-70242
8 min read | Updated: October 29, 2026 | First published: October 29, 2026 | Sources: Microsoft MSRC CVE-2026-70242, Microsoft Learn Office security updates October 13, 2026, Automox Patch Tuesday analysis | By Guerni Ala Eddine
TL;DR: A fully patched Windows PC can still be running an old Outlook. Microsoft's October 13, 2026 Office security updates fix several Critical Outlook remote-code-execution bugs, including CVE-2026-70242 (CVSS 9.8). Microsoft's own vector is network, no privileges, no user interaction: a crafted message can execute when classic desktop Outlook shows it in the Reading Pane - no click, no attachment open. Microsoft rates exploitation Less Likely, lists exploit maturity as unproven, and has not reported in-the-wild use. Office updates arrive from the Office CDN, not Windows Update, so "Windows is up to date" is the wrong check. This guide is the two-minute Office build check against Microsoft's published floors.
Quick answer - what do I click? Open classic Outlook (the desktop app with File on the ribbon) → File → Office Account (or Account) → About Outlook. Write down Version and Build. For Microsoft 365 Current Channel, the October 13 security floor is Version 2609, Build 20430.20182 or any later Current Channel build (2610 is already out). Then Update Options → Update Now. Outlook on the web, the Outlook mobile apps, and a PC that only uses Gmail in Chrome are not this CVE. Microsoft has not said these bugs are being exploited. Patch anyway; do not wait for a headline.

Why Windows Update Is the Wrong Dashboard

October's Windows cumulative (the one that closed the exploited Shell/MOTW issue) is a separate stream. Microsoft 365 Apps and Outlook Click-to-Run pull from Office's own channel. Automox's October Patch Tuesday write-up is blunt: endpoints can show fully patched Windows while Office lags the security build. That is the gap this article exists to close.

CVE-2026-70242 is a heap-based buffer overflow in Microsoft Office Outlook. Microsoft classifies it Critical, RCE, CVSS 9.8, UI:None. The same October Office package lists additional Outlook RCEs in the same class (including CVE-2026-70291, CVE-2026-88156, CVE-2026-97016, CVE-2026-97749). You do not need five different procedures. One current Office build covers the October Outlook set Microsoft published on Learn.

This is the second consecutive month Microsoft fixed a Reading Pane-style Outlook RCE (September's was CVE-2026-78509, per Automox). The user-training line "don't click the link" does not apply if preview is enough. That is why the build number matters more than a lecture.

Honest limits: Microsoft's temporal metric is Unproven. Rapid7 and Automox both record Microsoft's "Exploitation Less Likely" and no confirmed attacks as of the October analysis. This site will not invent a worm. A 9.8 preview-pane bug with an official fix is still worth two minutes.

Who Is In Scope

What you runThis article?October 13, 2026 security floor (Microsoft Learn)
Microsoft 365 Apps, Current ChannelYesVersion 2609 (Build 20430.20182) or later (2610 is newer and fine)
Microsoft 365 Apps, Monthly EnterpriseYes2609 (20430.20180), or the listed 2608 / 2607 security builds for that channel
Office LTSC 2024 (volume)YesVersion 2408 (Build 17932.21056) or later
Office LTSC 2021 (volume)YesVersion 2108 (Build 14334.20974) or later. Microsoft's LTSC 2021 end of support is October 13, 2026 - same day as this update. Plan to leave LTSC 2021 after you patch.
Office 2024 / 2021 Retail Click-to-RunYesLearn lists 2609 (20430.20182) and 2608 (20326.20232) respectively for October 13
Outlook on the web, Gmail, Apple Mail, New Outlook if it is not the Win32 Microsoft 365 Apps OutlookNot these CVEs as listedStill keep the browser and OS patched; this check is for classic desktop Outlook
Outlook for Android / iPhoneNoDifferent product. See the Authenticator Android build check if you use work accounts on the phone.

U.S. small offices on Microsoft 365 with Preview Pane on are the audience. If your company locks Office updates, this check still tells you whether the PC is behind; it cannot override IT policy.

The Two-Minute Check

  1. Open classic Outlook. Look for File on the left of the ribbon. If you only have a simplified "New Outlook" switch and no Office Account page, you may not be on the Win32 app this advisory names. Use the Microsoft 365 Apps Outlook, not the browser.
  2. File → Office Account → About Outlook. Copy the full Version and Build line (example shape: Version 2609 Build 16.0.20430.20182). The four-part build is the number you compare, not "Outlook is installed."
  3. Compare to the floor for your channel in the table above. Current Channel at or above 20430.20182 (or 2610's 20527.x) is past the October 13 Outlook security release. A 2608 Current Channel box that never took October Office updates is behind even if Windows Update is green.
  4. Update Now. Same page: Update Options → Update Now. Keep Outlook closed if the updater asks. Then reopen About Outlook and confirm the build actually moved. If Update Now is greyed out, the PC is managed - screenshot About Outlook and send it to IT rather than fighting the policy.
What About Outlook showsStatusNext
Current Channel 2609 build 20430.20182+ or 2610At or past October 13 Office securityDone for this wave
Older 16.0.20430.x below 20182, or 2608 Current with no October buildBehind the Outlook RCE packageUpdate Now, then re-check
LTSC 2021 below 14334.20974Affected and near/at end of supportPatch this build, then plan Microsoft 365 Apps or LTSC 2024
Windows Update says up to date, Office build oldThe exact miss this article is forOffice Account, not Settings → Windows Update

How to Patch Without Guessing

Microsoft's public list of Office security builds is Release notes for Microsoft Office security updates. The Click-to-Run history by date is on Learn as well. Home and small-business Current Channel users: Update Now is enough. Do not download random "Outlook.exe" installers.

While the download runs, optional hardening (not a substitute for the patch): View → Reading Pane → Off, or render mail as plain text. Automox notes those reduce what a crafted preview can parse. Turn the pane back on after the new build is confirmed if you need it for work.

Keep the OS current too - that is a different door (MOTW / Shell). Our KB5127648 guide covers the October Windows baseline. If Windows Update itself is stuck, use the 0x80073712 playbook.

What This Is Not

It is not proof your inbox already ran code. Microsoft has not reported exploitation. It is not the Authenticator Android broker bug. It is not "disable email." It is not Outlook on the web.

If a popup says "Outlook locked, call this number," that is the old scam, not CVE-2026-70242. See fake virus popups. For mailbox rules and forwarding after a real incident, use the 15-minute mailbox audit and SPF/DKIM/DMARC. Suspicious headers: email forensic analyzer.

More checklists: all guides, Pro Tools, Plex2Shell, PHP2Shell patch audit.

Takeaways

  • October Outlook RCEs including CVE-2026-70242 are Critical, UI:None, Reading Pane. Microsoft: not reported in the wild, exploitation less likely, unproven exploit code.
  • Check About Outlook, not Windows Update.
  • Current Channel floor: 2609 / 20430.20182 (or newer 2610).
  • LTSC 2021 floor: 14334.20974, and that channel's support clock hit the same week.
  • Update Now, re-open About Outlook, confirm the build moved.

FAQ

I use New Outlook / the simplified app. Microsoft's affected products for CVE-2026-70242 are Microsoft 365 Apps and Office LTSC SKUs. If About Outlook does not exist, you are probably not on that Win32 binary. Still keep Microsoft 365 Apps updated if they are installed beside it.

Does turning off the Reading Pane replace the patch? No. It is a temporary reduction of preview parsing, not a fix.

Click-to-Run says up to date but the build is old. You may be on Monthly Enterprise or Semi-Annual with a delayed channel. Compare to the Learn row for your channel, not Current Channel's 2610.

Office 2019. Mainstream support ended October 14, 2025. Microsoft listed an Office 2019 volume build (1808 / 10417.20228) on the October 13, 2026 security notes at its discretion. Do not treat 2019 as a long-term plan.

Should I stop opening email? No. Patch the build. Preview-pane risk is why the update exists, not a reason to abandon mail.

About the author. Guerni Ala Eddine writes practical Windows and account checklists for ACSNETWORLD. This article uses Microsoft's CVE-2026-70242 advisory (October 13, 2026), Microsoft Learn Office security update builds for that date, and Automox's October Patch Tuesday analysis. It does not include exploit code.

Sources

  1. Microsoft MSRC - CVE-2026-70242
  2. CVE.org - CVE-2026-70242
  3. Microsoft Learn - Office security update builds (October 13, 2026)
  4. Microsoft Learn - Microsoft 365 Apps update history by date
  5. Automox - October 2026 Patch Tuesday (Reading Pane analysis)

Changelog. October 29, 2026 - Initial publication: two-minute About Outlook check, Microsoft Learn floors for Current Channel / LTSC, Windows Update vs Office CDN, no in-the-wild claim.

Get US tech fixes weekly

No spam. Unsubscribe anytime. Tested on Windows 11 24H2.

Join 1,200+ US readers. No spam.