Summary
Microsoft Outlook contains an improper input validation vulnerability that allows for remote code execution. Successful exploitation of this vulnerability would allow an attacker to bypass the Office Protected View and open in editing mode rather than protected mode.
- Vendor
- Microsoft
- Product
- Office Outlook
- Added to KEV
- Feb 6, 2025
- Remediation due
- Feb 27, 2025 (US federal deadline)
- Ransomware use
- Not known
- Weakness
- CWE-20
- EPSS
- 94.7% as of Nov 12
In the news
- No Asia-Pacific article names this CVE yet.
Linked
Actors named alongside it:
none
Incidents exploiting it:
- none recorded
References