Remote Code Execution Vulnerability in Microsoft Outlook

CVE-2024-38021

8.8HIGH

Key Information

Vendor: Microsoft
Status: Microsoft Office 2019; Microsoft 365 Apps For Enterprise; Microsoft Office Ltsc 2021; Microsoft Office 2016
Vendor: CVE Published:; 9 July 2024

Badges

😄 Trended👾 Exploit Exists📰 News Worthy

Summary

A critical zero-click remote code execution (RCE) vulnerability, designated CVE-2024-38021, has been discovered in Microsoft Outlook by Morphisec researchers. This vulnerability poses a significant threat because it can be exploited without any user interaction, particularly when emails are received from trusted senders. The potential impacts include data breaches, unauthorized access, and other malicious activities. Microsoft has released a patch for this vulnerability as part of its Patch Tuesday updates, and users are urged to ensure that their Microsoft Outlook and Office applications are updated with the latest patches. The lack of authentication requirements and the severity of this vulnerability have raised concerns about potential widespread exploitation.

Affected Version(s)

Microsoft Office 2019 < 19.0.0

Microsoft 365 Apps for Enterprise < 16.0.1

Microsoft Office LTSC 2021 < 16.0.1

News Articles

CybersecurityNews

CVE-2024-38021

Outlook Zero-click RCE Vulnerability Technical Details Released

The attack involves passing a composite moniker in an image tag URL. This bypasses the security measures implemented in the hyperlink creation function, leading to potential remote code execution and local NTLM credential leaks.

3 months ago