CVE-2024-21413

Microsoft Outlook Improper Input Validation Vulnerability

Microsoft — Office Outlook

Added to KEV catalog: 6 February 2025
Federal remediation due date: 27 February 2025
Weakness classification (CWE): CWE-20

CISA Description

Microsoft Outlook contains an improper input validation vulnerability that allows for remote code execution. Successful exploitation of this vulnerability would allow an attacker to bypass the Office Protected View and open in editing mode rather than protected mode.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21413 ; https://nvd.nist.gov/vuln/detail/CVE-2024-21413

View on NVD View on MITRE CVE View full CISA catalog

More Microsoft Vulnerabilities

CVE-2026-45659

Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability

CVE-2008-4250

Microsoft Windows Buffer Overflow Vulnerability

CVE-2009-1537

Microsoft DirectX NULL Byte Overwrite Vulnerability

CVE-2010-0249

Microsoft Internet Explorer Use-After-Free Vulnerability

CVE-2010-0806

Microsoft Internet Explorer Use-After-Free Vulnerability

Confirm Your Exposure

Is this vulnerability present in your environment?

CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.

Explore VAPT Services