{"id":"CVE-2024-38021","published":"2024-07-09T17:03:06Z","modified":"2026-02-10T23:34:57Z","title":"Microsoft Outlook Remote Code Execution Vulnerability","vendor":"Microsoft","product":"Microsoft Office 2019","tier":"core","eol":null,"affectedVersions":[{"vendor":"Microsoft","product":"Microsoft Office 2019","versions":[">= 19.0.0, < https://aka.ms/OfficeSecurityReleases"]},{"vendor":"Microsoft","product":"Microsoft 365 Apps for Enterprise","versions":[">= 16.0.1, < https://aka.ms/OfficeSecurityReleases"]},{"vendor":"Microsoft","product":"Microsoft Office LTSC 2021","versions":[">= 16.0.1, < https://aka.ms/OfficeSecurityReleases"]},{"vendor":"Microsoft","product":"Microsoft Office 2016","versions":[">= 16.0.0, < 16.0.5456.1000"]}],"description":{"text":"Microsoft Outlook Remote Code Execution Vulnerability","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.03497,"percentile":0.89125,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2024-11-20","exploitedFirstSeen":"2024-11-20","ransomware":false,"evidence":[{"url":"https://go.catonetworks.com/rs/245-RJK-441/images/CATO_CTRL_Report_Q3_2024.pdf","date":"2024-11-20"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38021","tags":["vendor-advisory","patch"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-37726","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-37726","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2024-07-09","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2024-38021","provenance":"source"},{"date":"2024-11-20","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://go.catonetworks.com/rs/245-RJK-441/images/CATO_CTRL_Report_Q3_2024.pdf","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":59.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 709 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":17.82,"detail":"percentile 0.8912"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-microsoft-office-cwe-20"}}