Exploited vulnerability

CVE-2024-21413

TLP:CLEAR

Microsoft Outlook Improper Input Validation Vulnerability

Microsoft Outlook contains an improper input validation vulnerability that allows for remote code execution. Successful exploitation of this vulnerability would allow an attacker to bypass the Office Protected View and open in editing mode rather than protected mode.

Facts

Vendor: Microsoft
Product: Office Outlook
CVSS: 9.8
EPSS (probability of exploitation within 30 days): 94.7 %
On CISA's Known Exploited Vulnerabilities list since: 6 February 2025
First known exploitation: 6 February 2025
CISA's deadline for US federal agencies: 27 February 2025
Weakness: CWE-20
First seen by Risk Letters: 6 February 2025

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD