CVE-2023-23397

CVE-2023-23397 is an Elevation of Privilege in Microsoft Outlook for Windows. Multiple connected sources describe exploitation via Outlook calendar reminders using a UNC path in the MAPI property PidLidReminderFileParameter, causing the victim to contact an attacker-controlled SMB share and leak ...

CVE-2017-11774

CVE-2017-11774 affects Microsoft Outlook clients (Outlook 2010 SP2, 2013 SP1/RT SP1, 2016) and enables code execution via Outlook home page/persistence vectors. The underlying issue is how Outlook handles in-memory objects, allowing an attacker to bypass security features and run arbitrary comman...

CVE-2023-35311

Technical details about CVE-2023-35311 are not publicly available in the provided connected documents. The sources confirm a Microsoft Outlook security feature bypass but do not specify root cause, affected versions, or fixes. Monitor for updates.

CVE-2023-36763

CVE-2023-36763 is a Microsoft Outlook information disclosure vulnerability. Public documentation identifies it as affecting Outlook 2016 (KB5002499) and related Office/Outlook components; severity is high (CVSSv3.1: 7.5, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). The vulnerability orig...

CVE-2024-21378

The connected document describes a GitHub exploit example for CVE-2024-21378 targeting Microsoft Outlook via Exchange Online. It claims to execute arbitrary code by delivering a malicious COM DLL embedded in a form attachment, loaded into the Outlook process after user interaction in the thick cl...

CVE-2020-16947

CVE-2020-16947 refers to a remote code execution vulnerability in Microsoft Outlook caused by improper handling of objects in memory. The issue can allow arbitrary code execution in the context of the targeted user, with higher impact if the user account has administrative rights. Exploitation re...

CVE-2019-1084

CVE-2019-1084 affects Microsoft Exchange (display name creation with non-printable characters) leading to information disclosure. Root cause: display names with invalid characters bypass visibility controls and can be added to conversations; impact is partial confidentiality exposure per CVSS dat...

CVE-2026-70329

CVE-2026-70329 describes an integer overflow or wraparound in Microsoft Office Outlook that allows an unauthenticated attacker to achieve remote code execution over a network . The associated metrics indicate a CVSS v3.1 base score of 8.8 (HIGH) with attack vector: NETWORK , attack complexity: LO...

CVE-2022-35742

CVE-2022-35742 is a Microsoft Outlook Denial of Service vulnerability. Public sources (CVE entry, MSRC update page, and third‑party summaries) describe it as a DoS that can crash the Outlook client when processing a crafted message. The vulnerability is reported to be exploitable via network‑deli...

CVE-2020-0760

CVE-2020-0760 is a remote code execution vulnerability affecting Microsoft Office products (Word/Excel/PowerPoint/Visio) via improper loading of arbitrary type libraries. The root cause is how Office loads type libraries, which could allow an attacker to execute arbitrary code in the context of t...

CVE-2024-30103

CVE-2024-30103 is a confirmed Microsoft Outlook remote code execution vulnerability. The CVE affects Outlook components (e.g., Outlook.exe and related Office/Outlook binaries) and is exploitable remotely without user interaction via a crafted email, per the CVSS_3.1 metrics (AV:N/AC:L/PR:L/UI:N/S...

CVE-2023-33131

CVE-2023-33131 is a Microsoft Outlook remote code execution vulnerability. Connected sources confirm affected product is Outlook (Office family) and describe exploitation via a malicious Word file delivered to Outlook users, with the exploit code example showing an AutoOpen macro invoking cmd.exe...

CVE-2020-16949

CVE-2020-16949 is a denial-of-service flaw in Microsoft Outlook where improper handling of in-memory objects leads to remote DoS after receiving a crafted e‑mail. Public details from multiple sources confirm Outlook vulnerabilities across versions (notably Outlook 2013/KB4484524 references and MS...

CVE-2024-38020

CVE-2024-38020 is a Microsoft Office/Outlook spoofing vulnerability affecting Outlook components (Outlook/Office 2016). The issue allows an attacker to impersonate another user (spoofing) and, per accompanying advisories, is addressed by Microsoft security updates KB5002620/KB5002621 (Office 2016...

CVE-2023-36893

Technical details for CVE-2023-36893 are not provided in the connected documents. No explicit information on affected products, root cause, impact, or fixes is present. Monitor for updates from official sources.

CVE-2021-31949

CVE-2021-31949 is a public Microsoft Outlook/Office RCE vulnerability. The connected KB update (KB5001934) documents that this vulnerability is resolved by the June 8, 2021 security update for Outlook 2013 (MSI-based), and notes it does not apply to the Office 2013 Click-to-Run editions (e.g., Mi...

CVE-2025-21357

CVE-2025-21357 affects Microsoft Outlook and is a Remote Code Execution vulnerability in Outlook components. Public documents confirm Outlook is the affected product and that the root cause relates to a code execution path within Outlook, with several security updates released by Microsoft (e.g.,...

CVE-2018-0851

CVE-2018-0851 affects multiple Microsoft Office versions: Office 2007 SP2, Word Viewer, Office 2010 SP2, Office 2013 SP1/RT SP1, Office 2016, and Office 2016 Click-to-Run. The vulnerability arises from how Office handles objects in memory, described as a memory corruption issue that enables remot...

CVE-2020-1349

CVE-2020-1349 is an Outlook remote code execution vulnerability. It arises from improper handling of objects in memory, enabling code execution with the caller’s privileges when a user opens a specially crafted file or views content via Preview Pane. Public documentation notes that an attacker co...

CVE-2020-1493

CVE-2020-1493 describes an information-disclosure flaw in Microsoft Outlook where attaching a file as a link can cause the attachment to be accessible to unauthorized recipients when emails are shared. The root cause is how Outlook handles attachment links, enabling exposure beyond the intended p...

CVE-2020-17119

CVE-2020-17119 is an Outlook information-disclosure vulnerability that is referenced across multiple feeds as part of the Microsoft Office updates for macOS (December 2020). The initial entry identifies Outlook Information Disclosure as the issue, while connected documents confirm the CVE is bund...

CVE-2017-0204

CVE-2017-0204 affects Microsoft Outlook 2007 SP3, 2010 SP2, 2013 SP1, and 2016. The vulnerability is a security feature bypass where a specially crafted document bypasses Office Protected View by exploiting how Office handles file formats (security feature bypass). Impact described in connected d...

CVE-2020-1483

CVE-2020-1483 is a Microsoft Outlook remote code execution vulnerability caused by improper handling of in‑memory objects. An attacker could run code with the current user’s privileges; if the user has admin rights, the attacker could take full control of the system. Exploitation requires a user ...

CVE-2026-62882

The CVE-2026-62882 entry concerns Microsoft Office Outlook, with a vulnerability described as insufficiently protected credentials that allows an unauthenticated attacker to perform spoofing over a network. According to the CVSSv3.1 metrics, the impact is low confidentiality, no integrity or avai...

CVE-2021-28452

CVE-2021-28452 is a Microsoft Outlook memory corruption vulnerability described by the NVD and Microsoft MSRs as affecting Outlook components and addressed by security updates. Public docs in the provided set confirm: (1) the issue is a memory corruption vulnerability in Outlook (Microsoft Office...

CVE-2017-17689

CVE-2017-17689 arises from S/MIME CBC gadget attacks (EFAIL) that can lead to plaintext exfiltration. Connected sources show this affecting KDE PIM/KMail components and related mail tooling across Linux/macOS ecosystems, with public advisories describing how S/MIME/CBC malleability could leak pla...

CVE-2024-38173

CVE-2024-38173 is an Outlook remote code execution vulnerability affecting Microsoft Outlook/Office (e.g., Outlook 2016). Exploitation details in connected sources are limited, but the CVSSv3.1 vector indicates Local access, High impact on confidentiality/integrity/availability, with User interac...

CVE-2018-0791

CVE-2018-0791 affects Microsoft Outlook products (Outlook 2007, 2010, 2013, and 2016) and is a remote code execution flaw caused by the way email messages are parsed. The connected document notes this vulnerability is distinct from CVE-2018-0793, and describes the issue as a parsing-based RCE in ...

CVE-2019-1200

CVE-2019-1200 is a remote code execution flaw in Microsoft Outlook where memory handling of objects can be exploited by a specially crafted file. The issue could allow code execution in the current user’s security context if the targeted user opens the crafted file, with attack vectors including ...

CVE-2026-21260

CVE-2026-21260 affects Microsoft Office Outlook, where exposure of sensitive information to an unauthorized actor enables network-based spoofing. The entry cites a CVSSv3.1 base score of 7.5 (HIGH) with an attack vector of NETWORK and no privileges required, but has no exploitation details in the...

CVE-2017-0106

CVE-2017-0106 affects Microsoft Office components (Excel 2007 SP3; Outlook 2010 SP2, 2013 SP1, 2016) and enables remote code execution or memory corruption via a crafted document. Connected vulnerability feeds corroborate Office family exposure and link the CVE to multiple MS security updates (e....

CVE-2018-0850

CVE-2018-0850 affects Microsoft Outlook and Office components across Outlook 2007/2010/2013/2016 and Office 2016 Click-to-Run. The root cause is how the format of incoming messages is validated, enabling elevation of privileges when a victim processes a specially crafted email. Connected sources ...

CVE-2019-0560

This CVE-2019-0560 entry concerns a memory-based information disclosure in Microsoft Office and Office 365 ProPlus. Affected products are Microsoft Office components; root cause is improper handling of memory contents, enabling disclosure of sensitive data. Documented impact is information disclo...

CVE-2020-0696

Microsoft Outlook Security Feature Bypass (CVE-2020-0696) is described across multiple feeds as a vulnerability in how Outlook parses URI formats, categorized as a security feature bypass. No concrete exploit details, affected versions, or remediation steps are provided in the connected documents...

CVE-2017-8508

CVE-2017-8508 is a Microsoft Office security feature bypass vulnerability tied to improper handling/parsing of file formats. Connected documents explicitly list CVE-2017-8508 among Outlook/Office-related issues, showing that the bypass affects Office components when parsing certain file formats. ...

CVE-2019-0559

Microsoft Outlook Information Disclosure Vulnerability (CVE-2019-0559) affects Outlook and Office suite components, arising from improper handling of certain messages. The vulnerability is described as an information disclosure issue with Confidentiality impact (C), per CVSS3 vector CVSS:3.0/AV:N...

CVE-2017-8506

CVE-2017-8506 is a remote code execution vulnerability affecting Microsoft Office/Outlook, tied to parsing of crafted Office content (email/attachments). The connected Nessus/MS security data links this CVE to Outlook parsing of specially crafted messages and notes that it is addressed by Microso...

CVE-2018-8522

CVE-2018-8522 is a remote code execution in Microsoft Outlook where the vulnerability arises from improper handling of objects in memory, allowing an attacker to run code with the current user’s privileges when a specially crafted file is processed. CVE-2018-8582 is another Outlook RCE triggered ...

CVE-2018-8582

CVE-2018-8582 is a remote code execution flaw in Microsoft Outlook that arises when parsing specially crafted rule export files. The underlying issue is in Outlook’s handling of objects during parsing, allowing an attacker to execute arbitrary code on the affected system. A successful exploit cou...

CVE-2018-0852

CVE-2018-0852 affects multiple Microsoft Office/Outlook versions (Outlook 2007 SP3; 2017? not listed; Outlook 2010 SP2; 2013 SP1 and RT SP1; 2016; Office 2016 Click-to-Run). Vulnerability arises from how Outlook/Office handles objects in memory, enabling remote code execution. Impact is high (rem...

CVE-2017-11776

Summary of verified details (CVE-2017-11776) Affected product: Microsoft Office, specifically Outlook components used in Outlook 2016/Office 2016/Outlook-related services, per the CVE descriptions. Vulnerability: Information disclosure in Outlook 2016 where email contents can be disclosed due to ...

CVE-2018-8244

CVE-2018-8244 is an elevation-of-privilege vulnerability in Microsoft Outlook (Office) where attachment headers are not properly validated. Exploitation could occur when a user opens or processes a crafted attachment, enabling local privilege escalation. Public details specify affected products a...

CVE-2017-8571

CVE-2017-8571 is a security feature bypass affecting Microsoft Outlook included in Office (Outlook 2007 SP3, 2010 SP2, 2013 SP1, 2013 RT SP1, 2016). The root cause is improper handling/parsing of input and file formats by Outlook/Office, allowing bypass of built-in security checks. In affected de...

CVE-2019-1204

CVE-2019-1204 affects Microsoft Outlook. It is an elevation of privilege that occurs when processing incoming messages due to insufficient validation of message formatting, potentially causing Outlook to load a local or remote message store from a crafted email. The update notes that Office fully...

CVE-2017-8507

CVE-2017-8507 is a remote code execution vulnerability in Microsoft Office Outlook/Office parsing of specially crafted email messages. The root cause is a memory corruption flaw in parsing, enabling an attacker to execute code on a affected system after user interaction. The primary impact is hig...

CVE-2017-8572

CVE-2017-8572 affects Microsoft Outlook ( bundled in Office ) across multiple versions (Outlook 2007 SP3, 2010 SP2, 2013 SP1/RT SP1, 2016). The vulnerability is an information disclosure caused by the way memory contents are disclosed, as described in the CVE description. Connected Nessus/OpenVAS...

CVE-2018-8524

CVE-2018-8524 is an Outlook remote code execution vulnerability affecting Office 365 ProPlus, Microsoft Office, and Microsoft Outlook. The weakness stems from improper handling of in-memory objects, enabling an attacker to execute arbitrary code via a specially crafted file or input, with the att...

CVE-2016-3278

CVE-2016-3278 is a memory corruption vulnerability in Microsoft Outlook (Outlook 2010 SP2, 2013 SP1, 2013 RT SP1, and 2016) triggered by processing a specially crafted Office document. The root cause is a memory corruption flaw exploited via a crafted document, enabling remote code execution on a...

CVE-2017-8663

CVE-2017-8663 affects Microsoft Outlook components bundled with Office (outlook versions across 2007 SP3, 2010 SP2, 2013 SP1/RT SP1, 2016). The vulnerability stems from how Outlook parses specially crafted email messages, enabling remote code execution. Exploitation requires user interaction (e.g...

CVE-2018-8576

CVE-2018-8576 is a remote code execution vulnerability in Microsoft Outlook that occurs when Outlook fails to properly handle objects in memory. Affected products include Office 365 ProPlus, Microsoft Office, and Microsoft Outlook. The underlying issue is improper handling of in-memory objects, e...