The Digital Security Authority (DSA) wants to bring to your attention, a critical vulnerability (CVE-2024-30103) in Microsoft Outlook that allows attackers to execute malicious code simply by opening an email. This “zero-click” exploit doesn’t require user interaction and poses a serious threat.

Technical Details

CVE-2024-30103 is a critical vulnerability affecting Microsoft Outlook. This vulnerability, identified as a remote code execution (RCE) issue, allows attackers to execute arbitrary code on the affected systems. The vulnerability has a high CVSS v3 base score of 8.8, indicating its severe impact.

Affected Products:

Microsoft Outlook 2016 (32-bit & 64-bit):
Affected from 16.0.0.0 before 16.0.5452.1000

Microsoft Office 2019 (32-bit & 64-bit):
Affected from 19.0.0 before https://aka.ms/OfficeSecurityReleases 

Microsoft Office LTSC 2021 (32-bit & 64-bit):
Affected from 16.0.1 before  https://aka.ms/OfficeSecurityReleases 

Microsoft 365 Apps for Enterprise (32-bit & 64-bit):
Affected from 16.0.1 before  https://aka.ms/OfficeSecurityReleases 

Security Update: 

Microsoft Outlook 2016 (32-bit & 64-bit):
https://support.microsoft.com/en-gb/topic/description-of-the-security-update-for-outlook-2016-june-11-2024-kb5002600-82694147-2a94-4f09-97d3-f06586525df4

Microsoft Office 2019 (32-bit & 64-bit):
https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates

Microsoft Office LTSC 2021 (32-bit & 64-bit):
https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates

Microsoft 365 Apps for Enterprise (32-bit & 64-bit):
https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates

Recommendations

The Digital Security Authority recommends updating the affected versions to the fixed or latest versions released for Microsoft Outlook and Microsoft Office. Also, users are advised to apply any other security updates provided by Microsoft to mitigate this vulnerability. Additionally, organizations should implement security measures such as email filtering and monitoring for suspicious activity to prevent exploitation.

References

1. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30103
2. https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates
3. https://nvd.nist.gov/
4. https://vulmon.com/vulnerabilitydetails?qid=CVE-2024-30103

The information presented in this report is based on available data up to the 12^th of June 2024.