CVE-2024-21413

Timeline

Detection, updates, and resolution for this record.

1. Feb 13, 2024 · Catalog

   Detected

   Microsoft Outlook contains an improper input validation vulnerability that allows for remote code execution. Successful exploitation of this vulnerability would allow an attacker to bypass the Office Protected View and open in editing mode rather than protected mode.

2. Feb 6, 2025 · CISA KEV

   Known exploited

   Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

3. Feb 27, 2025 · CISA KEV

   Remediation due

   Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

4. Aug 10, 2026 · Catalog

   Updated

   Microsoft Outlook contains an improper input validation vulnerability that allows for remote code execution. Successful exploitation of this vulnerability would allow an attacker to bypass the Office Protected View and open in editing mode rather than protected mode.

Affected

• cpe microsoft/365 appsversion unspecified
• cpe microsoft/office 2016version unspecified
• cpe microsoft/office 2019version unspecified
• cpe microsoft/office long term servicing channel2021
• vendor Microsoft Office Outlookversion unspecified

Sources

• CISA KEVCVE-2024-21413

  Microsoft Outlook contains an improper input validation vulnerability that allows for remote code execution. Successful exploitation of this vulnerability would allow an attacker to bypass the Office Protected View and open in editing mode rather than protected mode.

  cisa.gov
• CVE.orgCVE-2024-21413

  Official CVE identifier

  cve.org
• FIRST EPSSCVE-2024-21413

  30-day exploitation probability 94.7%

  first.org
• NIST NVDCVE-2024-21413

  Microsoft Outlook Remote Code Execution Vulnerability

  nvd.nist.gov

References

• CISA note · msrc.microsoft.com
• CISA note · nvd.nist.gov
• Technical Description · research.checkpoint.com
• US Government Resource · cisa.gov
• Exploit · vicarius.io
• Mitigation · vicarius.io