Microsoft Outlook Out-of-Bounds Read Vulnerability Leading to Local Remote Code Execution

A vulnerability allowing out-of-bounds read has been identified in Microsoft Office Outlook. This issue enables an unauthorized attacker to execute code locally. The vulnerability is present in several versions of Microsoft Outlook, including the 2024 and 2021 LTSC releases, as well as Microsoft 365 Apps for Enterprise. Exploitation requires the user to open a specially crafted file, after which the attacker can execute arbitrary code on the user's machine.

Impact

Exploitation of this vulnerability allows for remote code execution on the affected system.

Remediation

Users can apply the security update available through the Microsoft Update Catalog. Instructions for downloading this update can be found on the Microsoft Office Update page.