So I just reported a very interesting bug in Outlook - took me a while to analyze and understand (part of) the root cause.. The bug allows to read the value of an MAPI property* and use it *directly* as a memory pointer. We know OOB (e.g. caused by integer overflow) bugs are not