CVE-2024-21413: Microsoft Outlook Improper Input Validation Vulnerability
First published: Tue Feb 13 2024(Updated: )
Microsoft Outlook contains an improper input validation vulnerability that allows for remote code execution. Successful exploitation of this vulnerability would allow an attacker to bypass the Office Protected View and open in editing mode rather than protected mode.
Credit: secure@microsoft.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Microsoft Office 2019 for Mac | ||
| Microsoft Office 2019 for Mac | ||
| Microsoft Office LTSC 2021 | ||
| Microsoft Office LTSC 2021 | ||
| Microsoft Office Professional Plus 2016 | ||
| Microsoft Office Professional Plus 2016 | ||
| Microsoft Outlook | ||
| Microsoft 365 Apps for Enterprise | ||
| Microsoft 365 Apps for Enterprise | ||
| Microsoft 365 Apps for enterprise | ||
| Microsoft Office | =2016 | |
| Microsoft Office | =2019 | |
| Microsoft Office Long Term Servicing Channel | =2021 |
Remedy
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.bleepingcomputer.com/news/security/microsoft-new-critical-outlook-rce-bug-exploited-as-zero-day/
- https://www.bleepingcomputer.com/news/security/new-critical-microsoft-outlook-rce-bug-is-trivial-to-exploit/
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21413 (Advisory)
- https://www.bleepingcomputer.com/news/security/microsoft-new-critical-exchange-bug-exploited-as-zero-day/
- https://www.bleepingcomputer.com/news/security/critical-rce-bug-in-microsoft-outlook-now-exploited-in-attacks/
- https://nvd.nist.gov/vuln/detail/CVE-2024-21413
- https://research.checkpoint.com/2024/the-risks-of-the-monikerlink-bug-in-microsoft-outlook-and-the-big-picture/
- https://www.bleepingcomputer.com/news/security/cisa-tags-windows-and-cisco-vulnerabilities-as-actively-exploited/
- https://www.theregister.com/2025/03/10/infosec_in_brief/
Peer vulnerabilities
(Found alongside the following vulnerabilities)
Frequently Asked Questions
What is the severity of CVE-2024-21413?
CVE-2024-21413 is categorized as a critical remote code execution vulnerability in Microsoft Outlook.
How do I fix CVE-2024-21413?
To mitigate CVE-2024-21413, ensure you apply the latest security updates provided by Microsoft for the affected software.
Which software is affected by CVE-2024-21413?
CVE-2024-21413 affects Microsoft 365 Apps for Enterprise, Microsoft Office 2019, Microsoft Office 2016, Microsoft Office LTSC 2021, and Microsoft Exchange Server.
Can CVE-2024-21413 be exploited remotely?
Yes, CVE-2024-21413 can be exploited remotely, potentially allowing attackers to execute arbitrary code on affected systems.
What are the potential impacts of CVE-2024-21413?
Exploitation of CVE-2024-21413 could lead to unauthorized access, data breaches, and complete control of affected systems.
- agent/author
- agent/first-publish-date
- agent/type
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/bleeping-computer
- source/BleepingComputer
- alias/CVE-2024-21413
- collector/msrc
- source/Microsoft
- alias/CVE-2024-21410
- collector/msrc-cve
- agent/remedy
- agent/description
- agent/weakness
- agent/severity
- agent/source
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/title
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/cisa-known-exploited
- source/CISA
- exploited/true
- collector/nvd-cve
- source/NVD
- collector/nvd-api
- agent/softwarecombine
- alias/CVE-2023-20118
- alias/CVE-2023-20025
- alias/CVE-2018-8639
- agent/references
- agent/tags
- agent/event
- agent/trending
- agent/news-ai
- collector/the-register
- source/The Register
- vendor/microsoft
- canonical/microsoft office 2019 for mac
- canonical/microsoft office ltsc 2021
- canonical/microsoft office professional plus 2016
- canonical/microsoft outlook
- canonical/microsoft 365 apps for enterprise
- canonical/microsoft office
- version/microsoft office/2016
- version/microsoft office/2019
- canonical/microsoft office long term servicing channel
- version/microsoft office long term servicing channel/2021