US government warns users to patch this critical Microsoft Outlook bug

(Image credit: Shutterstock / JarTee)

CISA adds an Outlook improper input validation bug to KEV
The deadline to patch is February 27 2025
Criminals are using it for remote code execution

The US Cybersecurity and Infrastructure Security Agency (CISA) has added a 2024 Outlook flaw to its catalog of known vulnerabilities, warning users about in-the-wild abuse, and giving federal agencies three weeks (until February 27) to patch up or stop using the tool entirely.

CVE-2024-21413 is an improper input validation flaw plaguing Microsoft Outlook. It was discovered in 2024 by Check Point’s researcher Haifei Li, and was given a severity score of 9.8/10 (critical). Cybercriminals could craft special email messages, loaded with a certain type of hyperlink, that would allow them to run arbitrary code remotely. By exploiting this vulnerability, attackers can bypass Outlook's Protected View (a feature designed to open potentially harmful files in read-only mode) and instead open malicious files in editing mode.

Microsoft patched the bug in late 2024, and warned users that the Preview Pane can also be used as an attack vector. In other words, victims don’t even need to open the email to get infected - previewing it in Outlook would suffice.

Significant risk

The vulnerability was found in different Office products, including Microsoft Office LTSC 2021, Microsoft 365 Apps for Enterprise, Microsoft Outlook 2016, and Microsoft Office 2019.

While there was no evidence of in-the-wild abuse at the time the patch was released, its addition to KEV means the vulnerability is now being actively used by miscreants.

"These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise," CISA says.

Aside from the Outlook vulnerability, the agency added another four bugs, including a 7-Zip Mark of the Web bypass flaw, a Dante discovery process control flaw, a CyberoamsOS SQL injection flaw, and a Sophos XG Firewall buffer overflow bug. Federal agencies need to patch all of these before March 2025.

Dangerous Microsoft Outlook flaw could let hackers send out malware via email
We've rounded up the best password managers
Take a look at our guide to the best authenticator app

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.