Microsoft Inbox COM Objects Use-After-Free Vulnerability Leading to Local Remote Code Execution

A use-after-free vulnerability has been identified in Inbox COM Objects, allowing an unauthorized attacker to execute code locally. This vulnerability arises from improper memory management, which creates a race condition that can be exploited by an attacker who sends a malicious file and convinces the user to open it.

Impact

Exploitation of this vulnerability allows for remote code execution on the affected system.

Remediation

Users can apply the security update for this vulnerability, which is available through the Microsoft Update Catalog. Specific update details can be found in the Microsoft Knowledge Base articles KB5066837 for Windows 10 and KB5066835 for Windows 11 and Windows Server 2025.