ZeroDay Findings
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2024-21413

Microsoft Outlook Improper Input Validation Vulnerability

Published Feb 13, 2024 · catalog updated Aug 10, 2026 · Microsoft Office Outlook

Severity
Critical9.8
Known exploitation
CISA KEV and VulnCheck KEV
EPSS
94.7%
Remediation
Remediation guidance
Affected products
cpe microsoft/365 apps · cpe microsoft/office 2016 · cpe microsoft/office 2019 · cpe microsoft/office long term servicing channel · vendor Microsoft Office Outlook

Microsoft Outlook contains an improper input validation vulnerability that allows for remote code execution. Successful exploitation of this vulnerability would allow an attacker to bypass the Office Protected View and open in editing mode rather than protected mode. Initial-access exploit intelligence.

Technical analysis

Mechanism and impact are interpreted from ingested advisories — not independent exploit research.

  • CWE classification

    Improper Input Validation

  • Prerequisites and impact

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

How to fix CVE-2024-21413

Grounded briefings

Catalog interpretations for three audiences. Each brief cites ingested metadata and the original advisories below. They are not independent research and they do not invent exploit steps.

Executive

CVE-2024-21413 is a critical public vulnerability record for Microsoft Office Outlook. CISA lists it as known exploited. Published remediation guidance: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. This summary is a catalog interpretation of the ingested metadata and cites the original advisories below.

System administrator

Identify whether Microsoft Office Outlook is in your estate, then compare installed versions with the affected ranges. Affected packages or ranges on record: microsoft/365 apps; microsoft/office 2016; microsoft/office 2019; microsoft/office long term servicing channel (2021). Published remediation guidance: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Prefer the vendor or distribution advisory linked in Sources before changing production systems. This is a catalog interpretation, not a runbook.

Security analyst

Signals on file: CVSS 9.8 (technical impact); EPSS 94.7% (30-day exploitation probability). CISA lists it as known exploited. Weakness classes: CWE-20. Sources contributing to this record: certfr, cisa_kev, cve_org, epss. Public exploit references, when present, are outbound links only and are not proof of active exploitation. This is a catalog interpretation of stored metadata.

Related intelligence

  • Exploitation evidence

    Confirmed in CISA KEV since May 14, 2024. Listed in CISA KEV and VulnCheck KEV.

  • Safe detection guidance

    Compare installed versions with the affected ranges below and verify the advisory from the original publisher. This site stores metadata and outbound links only; it does not ship exploit code or proof-of-concept payloads.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Feb 13, 2024 · Catalog

    Detected

    Microsoft Outlook contains an improper input validation vulnerability that allows for remote code execution. Successful exploitation of this vulnerability would allow an attacker to bypass the Office Protected View and open in editing mode rather than protected mode.

  2. Feb 6, 2025 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  3. Feb 27, 2025 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  4. Aug 10, 2026 · Catalog

    Updated

    Microsoft Outlook contains an improper input validation vulnerability that allows for remote code execution. Successful exploitation of this vulnerability would allow an attacker to bypass the Office Protected View and open in editing mode rather than protected mode.

Affected versions

Enter an installed version to get a verified affected / not-affected result against the ranges below.

  • cpe microsoft/365 appsversion unspecified
  • cpe microsoft/office 2016version unspecified
  • cpe microsoft/office 2019version unspecified
  • cpe microsoft/office long term servicing channel2021
  • vendor Microsoft Office Outlookversion unspecified

Sources

  • CERT-FRGovernment advisoryCVE-2024-21413

    \[Mise à jour du 15 mars 2024\] Ajout de précision concernant les défi-réponses NTLM \[Mise à jour du 22 février 2024\] Ajout de recommandations et de précisions sur le fonctionnement de la vulnérabilité. La vulnérabilité CVE-2024-21413 permet à un attaquant de contourner les mes

    cert.ssi.gouv.fr
  • CISA KEVConfirmed exploitationCVE-2024-21413

    Microsoft Outlook contains an improper input validation vulnerability that allows for remote code execution. Successful exploitation of this vulnerability would allow an attacker to bypass the Office Protected View and open in editing mode rather than protected mode.

    cisa.gov
  • CVE.orgVulnerability recordCVE-2024-21413

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2024-21413

    30-day exploitation probability 94.7%

    first.org
  • NIST NVDVulnerability recordCVE-2024-21413

    Microsoft Outlook Remote Code Execution Vulnerability

    nvd.nist.gov
  • VulnCheck KEVConfirmed exploitationCVE-2024-21413

    Microsoft Outlook contains an improper input validation vulnerability that allows for remote code execution. Successful exploitation of this vulnerability would allow an attacker to bypass the Office Protected View and open in editing mode rather than protected mode.

    vulncheck.com

References

Freshness

Last verified in this catalog Oct 17, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.