Microsoft Office Outlook Spoofing Vulnerability via Deserialization of Untrusted Data

A spoofing vulnerability has been identified in Microsoft Office Outlook, stemming from the deserialization of untrusted data. This issue allows an unauthorized attacker to manipulate data over a network, potentially leading to credential disclosure by triggering an outbound NTLM authentication attempt to an attacker-controlled server. The vulnerability affects multiple Microsoft Office products, including Outlook, Word, SharePoint Server, and various Office LTSC versions for Mac and Windows.

Impact

Exploitation of this vulnerability could lead to unauthorized spoofing over the network, with a heightened risk of credential disclosure.

Remediation

Users are advised to update to the latest security patches available for their version of Microsoft Office. Security update details can be found in the Microsoft Office Security Update Guide.