Actively exploited · Published Feb 13, 2024 · Assigned by microsoft
CVE-2024-21413Microsoft Outlook Remote Code Execution Vulnerability
Critical 9.8 Exploited
In plain English
A critical-severity improper input validation in Microsoft 365 Apps for Enterprise from Microsoft. Attackers are actively exploiting it in the wild (listed by CISA on February 6, 2025). The chance it is exploited in the next 30 days is estimated at 94.7% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Feb 27, 2025.
Official description
Microsoft Outlook Remote Code Execution Vulnerability
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Microsoft 365 Apps for Enterprise | 16.0.1 – before https://aka.ms/OfficeSecurityReleases |
| Microsoft | Microsoft Office 2016 | 16.0.0 – before 16.0.5435.1001 |
| Microsoft | Microsoft Office 2019 | 19.0.0 – before https://aka.ms/OfficeSecurityReleases |
| Microsoft | Microsoft Office LTSC 2021 | 16.0.1 – before https://aka.ms/OfficeSecurityReleases |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
References
- Microsoft Outlook Remote Code Execution Vulnerability vendor-advisory, patch
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21413 government-resource
- https://www.vicarius.io/vsociety/posts/cve-2024-21413-critical-monikerlink-vulnerability-affecting-microsoft-outlook-mitigation-script
- https://www.vicarius.io/vsociety/posts/cve-2024-21413-critical-monikerlink-vulnerability-affecting-microsoft-outlook-detection-script
- https://research.checkpoint.com/2024/the-risks-of-the-monikerlink-bug-in-microsoft-outlook-and-the-big-picture/ x_transferred