CVE-2024-21413

Published Feb 13, 2024

Last updated 4 days ago

Microsoft Outlook

Overview

AI description

Automated description summarized from trusted sources.

CVE-2024-21413 is a critical remote code execution (RCE) vulnerability affecting Microsoft Outlook. It is classified as an "Improper Input Validation Vulnerability". The vulnerability arises from how Outlook processes certain URLs, especially those using the file:// protocol and crafted URL structures. This "MonikerLink" bug allows attackers to bypass the Office Protected View feature and execute arbitrary code on a victim's machine, potentially leading to system compromise, data exfiltration, or malware installation. This can be achieved by sending a malicious email, and in some cases, simply previewing the email is enough to trigger the exploit.

Description: Microsoft Outlook Remote Code Execution Vulnerability
Source: secure@microsoft.com
NVD status: Analyzed
Products: 365_apps, office_2016, office_2019, office_long_term_servicing_channel

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: Microsoft Outlook Improper Input Validation Vulnerability
Exploit added on: Feb 6, 2025
Exploit action due: Feb 27, 2025
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Weaknesses

secure@microsoft.com: CWE-20
nvd@nist.gov: NVD-CWE-noinfo

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "40C15EDD-98D4-4D06-BA06-21AE0F33C72D"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:office_2016:-:*:*:*:-:*:x64:*",
            "vulnerable": true,
            "matchCriteriaId": "45A9ECE7-F173-47AB-A420-0B6F64A04D21"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:office_2016:-:*:*:*:-:*:x86:*",
            "vulnerable": true,
            "matchCriteriaId": "BF3B9F15-3077-4BC5-9EC5-7416A9FBDC70"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:office_2019:-:*:*:*:*:*:x64:*",
            "vulnerable": true,
            "matchCriteriaId": "241CDE2B-ABD0-4EFF-8D73-1766E32FA20F"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:office_2019:-:*:*:*:*:*:x86:*",
            "vulnerable": true,
            "matchCriteriaId": "14D63E3F-A431-4DD8-979F-811E8DAC423D"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "0B3EF1E5-4757-4CFA-AE72-6BA876D3C9FD"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.