US government warns users to patch this critical Microsoft Outlook bug
A critical Outlook flaw is being actively exploited
- CISA adds an Outlook improper input validation bug to KEV
- The deadline to patch is February 27 2025
- Criminals are using it for remote code execution
The US Cybersecurity and Infrastructure Security Agency (CISA) has added a 2024 Outlook flaw to its catalog of known vulnerabilities, warning users about in-the-wild abuse, and giving federal agencies three weeks (until February 27) to patch up or stop using the tool entirely.
CVE-2024-21413 is an improper input validation flaw plaguing Microsoft Outlook. It was discovered in 2024 by Check Point’s researcher Haifei Li, and was given a severity score of 9.8/10 (critical). Cybercriminals could craft special email messages, loaded with a certain type of hyperlink, that would allow them to run arbitrary code remotely. By exploiting this vulnerability, attackers can bypass Outlook's Protected View (a feature designed to open potentially harmful files in read-only mode) and instead open malicious files in editing mode.
Microsoft patched the bug in late 2024, and warned users that the Preview Pane can also be used as an attack vector. In other words, victims don’t even need to open the email to get infected - previewing it in Outlook would suffice.
Significant risk
The vulnerability was found in different Office products, including Microsoft Office LTSC 2021, Microsoft 365 Apps for Enterprise, Microsoft Outlook 2016, and Microsoft Office 2019.
While there was no evidence of in-the-wild abuse at the time the patch was released, its addition to KEV means the vulnerability is now being actively used by miscreants.
"These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise," CISA says.
Aside from the Outlook vulnerability, the agency added another four bugs, including a 7-Zip Mark of the Web bypass flaw, a Dante discovery process control flaw, a CyberoamsOS SQL injection flaw, and a Sophos XG Firewall buffer overflow bug. Federal agencies need to patch all of these before March 2025.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
You might also like
- Dangerous Microsoft Outlook flaw could let hackers send out malware via email
- We've rounded up the best password managers
- Take a look at our guide to the best authenticator app
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
You must confirm your public display name before commenting
Please logout and then login again, you will then be prompted to enter your display name.