CVE-2024-21413

The vulnerability results from improper validation of input data (CWE-20) during the processing of specially crafted MonikerLink type links in email messages. An attacker can send a victim a message containing a malicious link, which when opened or simply displayed in the preview pane can trigger code execution on the client side. The attack vector is network-based, requires no privileges or user interaction, making it exceptionally dangerous.

Successful exploitation of the vulnerability allows an attacker to execute arbitrary code remotely on the victim's computer with full impact on confidentiality, integrity, and system availability. This can lead to takeover of a workstation, theft of authentication credentials, or further lateral movement within the organization's network.

Patches available from the vendor should be applied immediately in accordance with the Microsoft security bulletin (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21413). Due to active exploitation of the vulnerability, the update should be treated as a priority. Until the patch is deployed, it is recommended to disable the message preview pane in Outlook and block suspicious links at the email gateway level.

Microsoft 365 Apps, Microsoft Office 2016, Microsoft Office 2019, Microsoft Office Long Term Servicing Channel (LTSC) — exact versions indicated in vendor references (MSRC).

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Microsoft Outlook contains an improper input validation vulnerability that allows for remote code execution. Successful exploitation of this vulnerability would allow an attacker to bypass the Office Protected View and open in editing mode rather than protected mode.