CVE-2024-21413KEV · OVERDUECWE-20

Microsoft Outlook Improper Input Validation Vulnerability

Critical · published February 13, 2024

Patch now

Confirmed exploited, and the score agrees

CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 99.9th percentile for exploit probability.

604
days past CISA
deadline
CVSS v3.1
9.8
EPSS
95%
Percentile
99.9
In the wild
Confirmed
What it is

🚨 A simple email could be all it takes for an attacker to execute code on your system—absolutely devastating! 🔥 Think of it like a sneaky guest at a dinner party who, with just a well-placed comment, gets everyone to follow their lead, setting off chaos in the kitchen. In this case, opening a malicious email could open the floodgates for unwanted guests (attacks) in your system. This vulnerability allows attackers to run arbitrary code, meaning they could steal sensitive information, unleash malware, or even take full control of your system. It’s like handing over the keys to your house without realizing an intruder was standing right behind you. The potential damage is enormous!

Put simply

Think of it like a sneaky guest at a dinner party who, with just a well-placed comment, gets everyone to follow their lead, setting off chaos in the kitchen. In this case, opening a malicious email could open the floodgates for unwanted guests (attacks) in your system. The Microsoft Outlook Remote Code Execution Vulnerability arises from improper handling of objects in memory, allowing attackers to send specially crafted emails that exploit this flaw and run malicious code.

What to do

This vulnerability allows attackers to run arbitrary code, meaning they could steal sensitive information, unleash malware, or even take full control of your system. It’s like handing over the keys to your house without realizing an intruder was standing right behind you. The potential damage is enormous! Immediately update Outlook to the latest version to patch this critical vulnerability. Also, consider implementing strict email filtering and monitoring to catch any suspicious email activity. Don't delay—this is a hot target! You've got this! By taking these steps, you're not just protecting yourself but also making the internet a safer place! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.94660 · 99.9th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2024-02-13T23:16Z
KEV added
2025-02-06 · due 2025-02-27
Affected products (6)
ProductVersionsFixed in
microsoft/365_appsall versions—
microsoft/office_2016all versions—
microsoft/office_2016all versions—
microsoft/office_2019all versions—
microsoft/office_2019all versions—
microsoft/office_long_term_servicing_channelall versions—
References (6)
EPSS history
Timeline
  • 06 FEB 00:00Z
    Added to CISA KEV — remediate by Feb 27
    kev
  • 13 FEB 18:02Z
    Microsoft Outlook Remote Code Execution Vulnerability
    cvelistv5