February 6, 2025 · Applied Cybernetics Group
CVE-2024-21413 — Microsoft Office Outlook
Microsoft Outlook Improper Input Validation Vulnerability
- Added to KEV
2025-02-06- Federal due date
2025-02-27- Vendor
- Microsoft
- Product
- Office Outlook
- EPSS
- 99.8th percentile (score 0.930, as of
2026-06-08) - NVD CVSS v3.1
- —
- Ransomware use
- Unknown
- Upstream
- https://nvd.nist.gov/vuln/detail/CVE-2024-21413
CISA short description
Microsoft Outlook contains an improper input validation vulnerability that allows for remote code execution. Successful exploitation of this vulnerability would allow an attacker to bypass the Office Protected View and open in editing mode rather than protected mode.
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.