An elevation of privilege vulnerability exists when Microsoft Outlook initiates processing of incoming messages without sufficient validation of the formatting of the messages. An attacker who successfully exploited the vulnerability could attempt to force Outlook to load a local
An elevation of privilege vulnerability exists when Microsoft Outlook initiates processing of incoming messages without sufficient validation of the formatting of the messages. An attacker who successfully exploited the vulnerability could attempt to force Outlook to load a local or remote message store (over SMB). To exploit the vulnerability, the attacker could send a specially crafted email to…
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Microsoft Office 2019 | 19.0.0 |
| Microsoft | Office 365 ProPlus | 16.0.0 |
| Microsoft | Microsoft Outlook 2016 | 16.0.0.0 |
| Microsoft | Microsoft Outlook 2013 Service Pack 1 | 15.0.0.0 |
| Microsoft | Microsoft Outlook 2010 Service Pack 2 | 13.0.0.0 |
Not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS is the best forward-looking signal — see the EPSS row above.
For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.
Ask SARA in chat to draft a starting detection for this CVE in your stack of choice.
No directly-cited follow-up CVEs in the KB record for this advisory. The references list in section 09 carries the vendor cross-references.