Microsoft Outlook
Recent Microsoft Outlook Security Advisories
Advisory | Title | Published |
---|---|---|
CVE-2023-36763 | Microsoft Outlook Information Disclosure Vulnerability | September 12, 2023 |
CVE-2023-36893 | Microsoft Outlook Spoofing Vulnerability | August 8, 2023 |
CVE-2023-36895 | Microsoft Outlook Remote Code Execution Vulnerability | August 8, 2023 |
CVE-2023-33151 | Microsoft Outlook Spoofing Vulnerability | July 11, 2023 |
CVE-2023-33153 | Microsoft Outlook Remote Code Execution Vulnerability | July 11, 2023 |
CVE-2023-35311 | Microsoft Outlook Security Feature Bypass Vulnerability | July 11, 2023 |
CVE-2023-35311 | Microsoft Outlook Security Feature Bypass Vulnerability | July 11, 2023 |
CVE-2023-33131 | Microsoft Outlook Remote Code Execution Vulnerability | June 13, 2023 |
CVE-2023-23397 | Microsoft Outlook Elevation of Privilege Vulnerability | March 14, 2023 |
CVE-2022-24480 | Outlook for Android Elevation of Privilege Vulnerability | December 13, 2022 |
Known Exploited Microsoft Outlook Vulnerabilities
The following Microsoft Outlook vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.
Title | Description | Added |
---|---|---|
Microsoft Outlook Security Feature Bypass Vulnerability | Microsoft Outlook contains a security feature bypass vulnerability that allows an attacker to bypass the Microsoft Outlook Security Notice prompt. CVE-2023-35311 | July 11, 2023 |
By the Year
In 2023 there have been 6 vulnerabilities in Microsoft Outlook with an average score of 8.2 out of ten. Last year Outlook had 1 security vulnerability published. That is, 5 more vulnerabilities have already been reported in 2023 as compared to last year. However, the average CVE base score of the vulnerabilities in 2023 is greater by 1.85.
Year | Vulnerabilities | Average Score |
---|---|---|
2023 | 6 | 8.15 |
2022 | 1 | 6.30 |
2021 | 3 | 7.63 |
2020 | 9 | 7.31 |
2019 | 7 | 5.91 |
2018 | 9 | 7.84 |
It may take a day or so for new Outlook vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Microsoft Outlook Security Vulnerabilities
Microsoft Outlook Information Disclosure Vulnerability
CVE-2023-36763
7.5 - High
- September 12, 2023
Microsoft Outlook Information Disclosure Vulnerability
Microsoft Outlook Spoofing Vulnerability
CVE-2023-36893
6.5 - Medium
- August 08, 2023
Microsoft Outlook Spoofing Vulnerability
Microsoft Outlook Security Feature Bypass Vulnerability
CVE-2023-35311
8.8 - High
- July 11, 2023
Microsoft Outlook Security Feature Bypass Vulnerability
Microsoft Outlook Remote Code Execution Vulnerability
CVE-2023-33131
8.8 - High
- June 14, 2023
Microsoft Outlook Remote Code Execution Vulnerability
Microsoft Outlook Denial of Service Vulnerability
CVE-2022-35742
7.5 - High
- June 01, 2023
Microsoft Outlook Denial of Service Vulnerability
Microsoft Outlook Elevation of Privilege Vulnerability
CVE-2023-23397
9.8 - Critical
- March 14, 2023
Microsoft Outlook Elevation of Privilege Vulnerability
Authentication Bypass by Capture-replay
Outlook for Android Elevation of Privilege Vulnerability.
CVE-2022-24480
6.3 - Medium
- December 13, 2022
Outlook for Android Elevation of Privilege Vulnerability.
Microsoft Outlook Remote Code Execution Vulnerability
CVE-2021-31949
7.3 - High
- June 08, 2021
Microsoft Outlook Remote Code Execution Vulnerability
Microsoft Office Graphics Remote Code Execution Vulnerability
CVE-2021-31941
7.8 - High
- June 08, 2021
Microsoft Office Graphics Remote Code Execution Vulnerability
Microsoft Outlook Memory Corruption Vulnerability
CVE-2021-28452
7.8 - High
- April 13, 2021
Microsoft Outlook Memory Corruption Vulnerability
Memory Corruption
Microsoft Outlook Information Disclosure Vulnerability
CVE-2020-17119
7.5 - High
- December 10, 2020
Microsoft Outlook Information Disclosure Vulnerability
A denial of service vulnerability exists in Microsoft Outlook software when the software fails to properly handle objects in memory
CVE-2020-16949
7.5 - High
- October 16, 2020
A denial of service vulnerability exists in Microsoft Outlook software when the software fails to properly handle objects in memory, aka 'Microsoft Outlook Denial of Service Vulnerability'.
Memory Leak
A remote code execution vulnerability exists in Microsoft Outlook software when the software fails to properly handle objects in memory
CVE-2020-16947
8.8 - High
- October 16, 2020
A remote code execution vulnerability exists in Microsoft Outlook software when the software fails to properly handle objects in memory, aka 'Microsoft Outlook Remote Code Execution Vulnerability'.
Out-of-bounds Read
A remote code execution vulnerability exists in Microsoft Outlook when the software fails to properly handle objects in memory
CVE-2020-1483
8.8 - High
- August 17, 2020
A remote code execution vulnerability exists in Microsoft Outlook when the software fails to properly handle objects in memory, aka 'Microsoft Outlook Memory Corruption Vulnerability'.
Buffer Overflow
An information disclosure vulnerability exists when attaching files to Outlook messages
CVE-2020-1493
5.5 - Medium
- August 17, 2020
An information disclosure vulnerability exists when attaching files to Outlook messages, aka 'Microsoft Outlook Information Disclosure Vulnerability'.
A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory
CVE-2020-1349
7.8 - High
- July 14, 2020
A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory, aka 'Microsoft Outlook Remote Code Execution Vulnerability'.
A remote code execution vulnerability exists when Microsoft Office improperly loads arbitrary type libraries
CVE-2020-0760
8.8 - High
- April 15, 2020
A remote code execution vulnerability exists when Microsoft Office improperly loads arbitrary type libraries, aka 'Microsoft Office Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0991.
Improper Input Validation
A security feature bypass vulnerability exists in Microsoft Outlook software when it improperly handles the parsing of URI formats
CVE-2020-0696
6.5 - Medium
- February 11, 2020
A security feature bypass vulnerability exists in Microsoft Outlook software when it improperly handles the parsing of URI formats, aka 'Microsoft Outlook Security Feature Bypass Vulnerability'.
A spoofing vulnerability exists in the way Microsoft Outlook for Android software parses specifically crafted email messages
CVE-2019-1460
4.6 - Medium
- January 24, 2020
A spoofing vulnerability exists in the way Microsoft Outlook for Android software parses specifically crafted email messages, aka 'Outlook for Android Spoofing Vulnerability'.
A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory
CVE-2019-1200
7.8 - High
- August 14, 2019
A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory, aka 'Microsoft Outlook Remote Code Execution Vulnerability'.
An elevation of privilege vulnerability exists when Microsoft Outlook initiates processing of incoming messages without sufficient validation of the formatting of the messages
CVE-2019-1204
4.3 - Medium
- August 14, 2019
An elevation of privilege vulnerability exists when Microsoft Outlook initiates processing of incoming messages without sufficient validation of the formatting of the messages, aka 'Microsoft Outlook Elevation of Privilege Vulnerability'.
Improper Input Validation
A spoofing vulnerability exists in the way Microsoft Outlook iOS software parses specifically crafted email messages
CVE-2019-1218
5.4 - Medium
- August 14, 2019
A spoofing vulnerability exists in the way Microsoft Outlook iOS software parses specifically crafted email messages, aka 'Outlook iOS Spoofing Vulnerability'.
XSS
A spoofing vulnerability exists in the way Microsoft Outlook for Android software parses specifically crafted email messages
CVE-2019-1105
5.4 - Medium
- July 29, 2019
A spoofing vulnerability exists in the way Microsoft Outlook for Android software parses specifically crafted email messages, aka 'Outlook for Android Spoofing Vulnerability'.
XSS
An information disclosure vulnerability exists when Exchange allows creation of entities with Display Names having non-printable characters
CVE-2019-1084
6.5 - Medium
- July 15, 2019
An information disclosure vulnerability exists when Exchange allows creation of entities with Display Names having non-printable characters. An authenticated attacker could exploit this vulnerability by creating entities with invalid display names, which, when added to conversations, remain invisible. This security update addresses the issue by validating display names upon creation in Microsoft Exchange, and by rendering invalid display names correctly in Microsoft Outlook clients., aka 'Microsoft Exchange Information Disclosure Vulnerability'.
Information Disclosure
An information disclosure vulnerability exists when Microsoft Office improperly discloses the contents of its memory
CVE-2019-0560
5.5 - Medium
- January 08, 2019
An information disclosure vulnerability exists when Microsoft Office improperly discloses the contents of its memory, aka "Microsoft Office Information Disclosure Vulnerability." This affects Office 365 ProPlus, Microsoft Office.
An information disclosure vulnerability exists when Microsoft Outlook improperly handles certain types of messages
CVE-2019-0559
6.5 - Medium
- January 08, 2019
An information disclosure vulnerability exists when Microsoft Outlook improperly handles certain types of messages, aka "Microsoft Outlook Information Disclosure Vulnerability." This affects Office 365 ProPlus, Microsoft Office, Microsoft Outlook.
A remote code execution vulnerability exists in the way
CVE-2018-8582
8.8 - High
- November 14, 2018
A remote code execution vulnerability exists in the way that Microsoft Outlook parses specially modified rule export files, aka "Microsoft Outlook Remote Code Execution Vulnerability." This affects Office 365 ProPlus, Microsoft Office, Microsoft Outlook. This CVE ID is unique from CVE-2018-8522, CVE-2018-8524, CVE-2018-8576.
A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory
CVE-2018-8522
7.8 - High
- November 14, 2018
A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory, aka "Microsoft Outlook Remote Code Execution Vulnerability." This affects Office 365 ProPlus, Microsoft Office, Microsoft Outlook. This CVE ID is unique from CVE-2018-8524, CVE-2018-8576, CVE-2018-8582.
A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory
CVE-2018-8524
7.8 - High
- November 14, 2018
A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory, aka "Microsoft Outlook Remote Code Execution Vulnerability." This affects Office 365 ProPlus, Microsoft Office, Microsoft Outlook. This CVE ID is unique from CVE-2018-8522, CVE-2018-8576, CVE-2018-8582.
A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory
CVE-2018-8576
7.8 - High
- November 14, 2018
A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory, aka "Microsoft Outlook Remote Code Execution Vulnerability." This affects Office 365 ProPlus, Microsoft Office, Microsoft Outlook. This CVE ID is unique from CVE-2018-8522, CVE-2018-8524, CVE-2018-8582.
An elevation of privilege vulnerability exists when Microsoft Outlook does not validate attachment headers properly
CVE-2018-8244
6.5 - Medium
- June 14, 2018
An elevation of privilege vulnerability exists when Microsoft Outlook does not validate attachment headers properly, aka "Microsoft Outlook Elevation of Privilege Vulnerability." This affects Microsoft Office, Microsoft Outlook.
Improper Input Validation
Microsoft Outlook 2007, Microsoft Outlook 2010, Microsoft Outlook 2013, Microsoft Outlook 2016, and Microsoft Office 2016 Click-to-Run
CVE-2018-0850
6.5 - Medium
- February 15, 2018
Microsoft Outlook 2007, Microsoft Outlook 2010, Microsoft Outlook 2013, Microsoft Outlook 2016, and Microsoft Office 2016 Click-to-Run allow an elevation of privilege vulnerability due to how the format of incoming message is validated, aka "Microsoft Outlook Elevation of Privilege Vulnerability".
Microsoft Office 2007 SP2, Microsoft Office Word Viewer, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1 and RT SP1, Microsoft Office 2016, and Microsoft Office 2016 Click-to-Run (C2R)
CVE-2018-0851
8.8 - High
- February 15, 2018
Microsoft Office 2007 SP2, Microsoft Office Word Viewer, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1 and RT SP1, Microsoft Office 2016, and Microsoft Office 2016 Click-to-Run (C2R) allow a remote code execution vulnerability, due to how Office handles objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE is unique from CVE-2018-0852.
Memory Corruption
Microsoft Outlook 2007 SP3, Microsoft Outlook 2010 SP2, Microsoft Outlook 2013 SP1 and RT SP1, Microsoft Outlook 2016, and Microsoft Office 2016 Click-to-Run (C2R)
CVE-2018-0852
8.8 - High
- February 15, 2018
Microsoft Outlook 2007 SP3, Microsoft Outlook 2010 SP2, Microsoft Outlook 2013 SP1 and RT SP1, Microsoft Outlook 2016, and Microsoft Office 2016 Click-to-Run (C2R) allow a remote code execution vulnerability, due to how Outlook handles objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE is unique from CVE-2018-0851.
Memory Corruption
Microsoft Outlook 2007, Microsoft Outlook 2010, Microsoft Outlook 2013, and Microsoft Outlook 2016
CVE-2018-0791
7.8 - High
- January 10, 2018
Microsoft Outlook 2007, Microsoft Outlook 2010, Microsoft Outlook 2013, and Microsoft Outlook 2016 allow a remote code execution vulnerability due to the way email messages are parsed, aka "Microsoft Outlook Remote Code Execution Vulnerability". This CVE is unique from CVE-2018-0793.
Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016
CVE-2017-11774
7.8 - High
- October 13, 2017
Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary commands, due to how Microsoft Office handles objects in memory, aka "Microsoft Outlook Security Feature Bypass Vulnerability."
Buffer Overflow
Microsoft Outlook 2007 SP3, Outlook 2010 SP2, Outlook 2013 SP1, Outlook 2013 RT SP1, and Outlook 2016 as packaged in Microsoft Office
CVE-2017-8663
7.8 - High
- August 01, 2017
Microsoft Outlook 2007 SP3, Outlook 2010 SP2, Outlook 2013 SP1, Outlook 2013 RT SP1, and Outlook 2016 as packaged in Microsoft Office allows a remote code execution vulnerability due to the way Microsoft Outlook parses specially crafted email messages, aka "Microsoft Office Outlook Memory Corruption Vulnerability"
Buffer Overflow
Microsoft Outlook 2007 SP3, Outlook 2010 SP2, Outlook 2013 SP1, Outlook 2013 RT SP1, and Outlook 2016 as packaged in Microsoft Office allows an information disclosure vulnerability due to the way
CVE-2017-8572
5.5 - Medium
- August 01, 2017
Microsoft Outlook 2007 SP3, Outlook 2010 SP2, Outlook 2013 SP1, Outlook 2013 RT SP1, and Outlook 2016 as packaged in Microsoft Office allows an information disclosure vulnerability due to the way that it discloses the contents of its memory, aka "Microsoft Office Outlook Information Disclosure Vulnerability".
Information Disclosure
Microsoft Outlook 2007 SP3, Outlook 2010 SP2, Outlook 2013 SP1, Outlook 2013 RT SP1, and Outlook 2016 as packaged in Microsoft Office allows a security feature bypass vulnerability due to the way
CVE-2017-8571
7.8 - High
- August 01, 2017
Microsoft Outlook 2007 SP3, Outlook 2010 SP2, Outlook 2013 SP1, Outlook 2013 RT SP1, and Outlook 2016 as packaged in Microsoft Office allows a security feature bypass vulnerability due to the way that it handles input, aka "Microsoft Office Outlook Security Feature Bypass Vulnerability".
Improper Input Validation
Microsoft Outlook 2007 SP3, Outlook 2010 SP2, Outlook 2013 SP1, Outlook 2013 RT SP1, Outlook 2016, and Outlook 2016 for Mac do not properly implement RFC 2046, which
CVE-2016-3366
6.5 - Medium
- September 14, 2016
Microsoft Outlook 2007 SP3, Outlook 2010 SP2, Outlook 2013 SP1, Outlook 2013 RT SP1, Outlook 2016, and Outlook 2016 for Mac do not properly implement RFC 2046, which allows remote attackers to bypass virus or spam detection via crafted MIME data in an e-mail attachment, aka "Microsoft Office Spoofing Vulnerability."
Authorization
Microsoft Outlook 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT does not properly expand metadata contained in S/MIME certificates, which
CVE-2013-3905
- November 13, 2013
Microsoft Outlook 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT does not properly expand metadata contained in S/MIME certificates, which allows remote attackers to obtain sensitive network configuration and state information via a crafted certificate in an e-mail message, aka "S/MIME AIA Vulnerability."
Information Disclosure
Microsoft Internet Explorer 6.0, Outlook 2002, and Outlook 2003 allow remote attackers to cause a denial of service (CPU consumption), if "Do not save encrypted pages to disk" is disabled, via a web site or HTML e-mail
CVE-2004-0284
- November 23, 2004
Microsoft Internet Explorer 6.0, Outlook 2002, and Outlook 2003 allow remote attackers to cause a denial of service (CPU consumption), if "Do not save encrypted pages to disk" is disabled, via a web site or HTML e-mail that contains two null characters (%00) after the host name.
Unknown versions of Internet Explorer and Outlook allow remote attackers to spoof a legitimate URL in the status bar via A HREF tags with modified "alt" values
CVE-2004-0526
- August 06, 2004
Unknown versions of Internet Explorer and Outlook allow remote attackers to spoof a legitimate URL in the status bar via A HREF tags with modified "alt" values that point to the legitimate site, combined with an image map whose href points to the malicious site, which facilitates a "phishing" attack.
Double free vulnerability in mshtml.dll for certain versions of Internet Explorer 6.x
CVE-2003-1048
- July 27, 2004
Double free vulnerability in mshtml.dll for certain versions of Internet Explorer 6.x allows remote attackers to cause a denial of service (application crash) via a malformed GIF image.
Buffer Overflow
MSHTML.DLL HTML parser in Internet Explorer 4.0, and other versions, allows remote attackers to cause a denial of service (application crash) via a script
CVE-2001-0322
- June 02, 2001
MSHTML.DLL HTML parser in Internet Explorer 4.0, and other versions, allows remote attackers to cause a denial of service (application crash) via a script that creates and deletes an object that is associated with the browser window object.
The Microsoft Active Setup ActiveX component in Internet Explorer 4.x and 5.x allows a remote attacker to install software components without prompting the user by stating
CVE-2000-0160
- February 21, 2000
The Microsoft Active Setup ActiveX component in Internet Explorer 4.x and 5.x allows a remote attacker to install software components without prompting the user by stating that the software's manufacturer is Microsoft.
A Microsoft ActiveX control
CVE-2000-0329
- November 11, 1999
A Microsoft ActiveX control allows a remote attacker to execute a malicious cabinet file via an attachment and an embedded script in an HTML mail, aka the "Active Setup Control" vulnerability.
A NETBIOS/SMB share password is the default
CVE-1999-0519
- January 01, 1997
A NETBIOS/SMB share password is the default, null, or missing.
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Microsoft Windows 95 or by Microsoft? Click the Watch button to subscribe.
