Microsoft Outlook Improper Input Validation Vulnerability (CVE-2024-21413)
Severity: critical · Patch status: patched · Since 2025-02-06 · CVE-2024-21413
Microsoft Outlook contains an improper input validation vulnerability that allows for remote code execution. Successful exploitation of this vulnerability would allow an attacker to bypass the Office Protected View and open in editing mode rather than protected mode. CISA added CVE-2024-21413 to its Known Exploited Vulnerabilities catalog on Feb 6, 2025, which means attackers are exploiting it in the wild.
What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- US federal agencies must remediate by Feb 27, 2025 (BOD 22-01); treat that as the outer limit.
Sources
All live incidents on Threat Watch
