Outlook (Microsoft) - vulnerabilities (CVEs)

126 CVEs, 0 in the last 30 days, 87 known versions, newest CVE from 2026-09-08. Vendor: Microsoft.

CVEs of Outlook

CVE-2026-80073 - CVSS 6.5 (medium), 2026-09-08: Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker to disclose information over a network.
CVE-2026-78519 - CVSS 8.8 (high), 2026-09-08: Use of uninitialized resource in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
CVE-2026-69629 - CVSS 8.8 (high), 2026-09-08: Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
CVE-2026-62882 - CVSS 4.3 (medium), 2026-08-11: Insufficiently protected credentials in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-70329 - CVSS 8.8 (high), 2026-08-11: Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
CVE-2026-42893 - CVSS 7.5 (high), 2026-05-12: Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to perform tampering over…
CVE-2026-26133 - CVSS 7.1 (high), 2026-03-16: AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.
CVE-2026-21260 - CVSS 7.5 (high), 2026-02-10: Exposure of sensitive information to an unauthorized actor in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.
CVE-2025-49699 - CVSS 7 (high), 2025-07-08: Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
CVE-2025-47171 - CVSS 6.7 (medium), 2025-06-10: Improper input validation in Microsoft Office Outlook allows an authorized attacker to execute code locally.
CVE-2025-29805 - CVSS 7.5 (high), 2025-04-08: Exposure of sensitive information to an unauthorized actor in Outlook for Android allows an unauthorized attacker to disclose information over a network.
CVE-2025-21259 - CVSS 5.3 (medium), 2025-02-11: Microsoft Outlook Spoofing Vulnerability
CVE-2025-21357 - CVSS 6.7 (medium), 2025-01-14: Microsoft Outlook Remote Code Execution Vulnerability
CVE-2025-21361 - CVSS 7.8 (high), 2025-01-14: Microsoft Outlook Remote Code Execution Vulnerability
CVE-2024-42220 - CVSS 9.1 (critical), 2024-12-18: A library injection vulnerability exists in Microsoft Outlook 16.83.3 for macOS. A specially crafted library can leverage Outlook's access privileges, leading…
CVE-2024-43604 - CVSS 8 (high), 2024-10-08: Outlook for Android Elevation of Privilege Vulnerability
CVE-2024-43482 - CVSS 6.5 (medium), 2024-09-10: Microsoft Outlook for iOS Information Disclosure Vulnerability
CVE-2024-38173 - CVSS 6.7 (medium), 2024-08-13: Microsoft Outlook Remote Code Execution Vulnerability
CVE-2024-38020 - CVSS 6.5 (medium), 2024-07-09: Microsoft Outlook Spoofing Vulnerability
CVE-2024-30103 - CVSS 8.8 (high), 2024-06-11: Microsoft Outlook Remote Code Execution Vulnerability
CVE-2024-20670 - CVSS 8.1 (high), 2024-04-09: Outlook for Windows Spoofing Vulnerability
CVE-2024-26204 - CVSS 7.5 (high), 2024-03-12: Outlook for Android Information Disclosure Vulnerability
CVE-2024-21378 - CVSS 8.8 (high), 2024-02-13: Microsoft Outlook Remote Code Execution Vulnerability
CVE-2023-36763 - CVSS 7.5 (high), 2023-09-12: Microsoft Outlook Information Disclosure Vulnerability
CVE-2023-36893 - CVSS 6.5 (medium), 2023-08-08: Microsoft Outlook Spoofing Vulnerability
CVE-2023-35311 - CVSS 8.8 (high), 2023-07-11: Microsoft Outlook Security Feature Bypass Vulnerability
CVE-2023-33151 - CVSS 6.5 (medium), 2023-07-11: Microsoft Outlook Spoofing Vulnerability
CVE-2023-33131 - CVSS 8.8 (high), 2023-06-14: Microsoft Outlook Remote Code Execution Vulnerability
CVE-2022-35742 - CVSS 7.5 (high), 2023-06-01: Microsoft Outlook Denial of Service Vulnerability
CVE-2023-23397 - CVSS 9.8 (critical), 2023-03-14: Microsoft Outlook Elevation of Privilege Vulnerability
CVE-2022-24480 - CVSS 6.3 (medium), 2022-12-13: Outlook for Android Elevation of Privilege Vulnerability
CVE-2021-31949 - CVSS 7.8 (high), 2021-06-08: Microsoft Outlook Remote Code Execution Vulnerability
CVE-2021-31941 - CVSS 7.8 (high), 2021-06-08: Microsoft Office Graphics Remote Code Execution Vulnerability
CVE-2021-28452 - CVSS 7.8 (high), 2021-04-13: Microsoft Outlook Memory Corruption Vulnerability
CVE-2020-17119 - CVSS 7.5 (high), 2020-12-10: Microsoft Outlook Information Disclosure Vulnerability
CVE-2020-16947 - CVSS 8.8 (high), 2020-10-16: <p>A remote code execution vulnerability exists in Microsoft Outlook software when the software fails to properly handle objects in memory. An attacker who…
CVE-2020-16949 - CVSS 7.5 (high), 2020-10-16: <p>A denial of service vulnerability exists in Microsoft Outlook software when the software fails to properly handle objects in memory. An attacker who…
CVE-2020-1493 - CVSS 5.5 (medium), 2020-08-17: An information disclosure vulnerability exists when attaching files to Outlook messages. This vulnerability could potentially allow users to share attached…
CVE-2020-1483 - CVSS 8.8 (high), 2020-08-17: A remote code execution vulnerability exists in Microsoft Outlook when the software fails to properly handle objects in memory. An attacker who successfully…
CVE-2020-1349 - CVSS 7.8 (high), 2020-07-14: A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory, aka 'Microsoft Outlook Remote…
CVE-2020-0760 - CVSS 8.8 (high), 2020-04-15: A remote code execution vulnerability exists when Microsoft Office improperly loads arbitrary type libraries, aka 'Microsoft Office Remote Code Execution…
CVE-2020-0696 - CVSS 6.5 (medium), 2020-02-11: A security feature bypass vulnerability exists in Microsoft Outlook software when it improperly handles the parsing of URI formats, aka 'Microsoft Outlook…
CVE-2019-1460 - CVSS 4.6 (medium), 2020-01-24: A spoofing vulnerability exists in the way Microsoft Outlook for Android software parses specifically crafted email messages, aka 'Outlook for Android…
CVE-2019-1218 - CVSS 5.4 (medium), 2019-08-14: A spoofing vulnerability exists in the way Microsoft Outlook iOS software parses specifically crafted email messages. An authenticated attacker could exploit…
CVE-2019-1204 - CVSS 4.3 (medium), 2019-08-14: An elevation of privilege vulnerability exists when Microsoft Outlook initiates processing of incoming messages without sufficient validation of the…
CVE-2019-1200 - CVSS 7.8 (high), 2019-08-14: A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory. An attacker who successfully…
CVE-2019-1105 - CVSS 5.4 (medium), 2019-07-29: A spoofing vulnerability exists in the way Microsoft Outlook for Android software parses specifically crafted email messages. An authenticated attacker could…
CVE-2019-1084 - CVSS 6.5 (medium), 2019-07-15: An information disclosure vulnerability exists when Exchange allows creation of entities with Display Names having non-printable characters. An authenticated…
CVE-2019-0559 - CVSS 6.5 (medium), 2019-01-08: An information disclosure vulnerability exists when Microsoft Outlook improperly handles certain types of messages, aka "Microsoft Outlook Information…
CVE-2019-0560 - CVSS 5.5 (medium), 2019-01-08: An information disclosure vulnerability exists when Microsoft Office improperly discloses the contents of its memory, aka "Microsoft Office Information…
CVE-2018-8582 - CVSS 8.8 (high), 2018-11-14: A remote code execution vulnerability exists in the way that Microsoft Outlook parses specially modified rule export files, aka "Microsoft Outlook Remote Code…
CVE-2018-8576 - CVSS 7.8 (high), 2018-11-14: A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory, aka "Microsoft Outlook Remote…
CVE-2018-8524 - CVSS 7.8 (high), 2018-11-14: A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory, aka "Microsoft Outlook Remote…
CVE-2018-8522 - CVSS 7.8 (high), 2018-11-14: A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory, aka "Microsoft Outlook Remote…
CVE-2018-8244 - CVSS 6.5 (medium), 2018-06-14: An elevation of privilege vulnerability exists when Microsoft Outlook does not validate attachment headers properly, aka "Microsoft Outlook Elevation of…
CVE-2017-17688 - CVSS 5.9 (medium), 2018-05-16: The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE:…
CVE-2017-17689 - CVSS 5.9 (medium), 2018-05-16: The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL.
CVE-2018-0850 - CVSS 6.5 (medium), 2018-02-15: Microsoft Outlook 2007, Microsoft Outlook 2010, Microsoft Outlook 2013, Microsoft Outlook 2016, and Microsoft Office 2016 Click-to-Run allow an elevation of…
CVE-2018-0852 - CVSS 8.8 (high), 2018-02-15: Microsoft Outlook 2007 SP3, Microsoft Outlook 2010 SP2, Microsoft Outlook 2013 SP1 and RT SP1, Microsoft Outlook 2016, and Microsoft Office 2016 Click-to-Run…
CVE-2018-0851 - CVSS 8.8 (high), 2018-02-15: Microsoft Office 2007 SP2, Microsoft Office Word Viewer, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1 and RT SP1, Microsoft Office 2016, and Microsoft…
CVE-2018-0791 - CVSS 7.8 (high), 2018-01-10: Microsoft Outlook 2007, Microsoft Outlook 2010, Microsoft Outlook 2013, and Microsoft Outlook 2016 allow a remote code execution vulnerability due to the way…
CVE-2017-11774 - CVSS 7.8 (high), 2017-10-13: Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary commands, due to how Microsoft Office handles…
CVE-2017-11776 - CVSS 7.5 (high), 2017-10-13: Microsoft Outlook 2016 allows an attacker to obtain the email content of a user, due to how Outlook 2016 discloses user email content, aka "Microsoft Outlook…
CVE-2017-8571 - CVSS 7.8 (high), 2017-08-01: Microsoft Outlook 2007 SP3, Outlook 2010 SP2, Outlook 2013 SP1, Outlook 2013 RT SP1, and Outlook 2016 as packaged in Microsoft Office allows a security…
CVE-2017-8663 - CVSS 7.8 (high), 2017-08-01: Microsoft Outlook 2007 SP3, Outlook 2010 SP2, Outlook 2013 SP1, Outlook 2013 RT SP1, and Outlook 2016 as packaged in Microsoft Office allows a remote code…
CVE-2017-8572 - CVSS 5.5 (medium), 2017-08-01: Microsoft Outlook 2007 SP3, Outlook 2010 SP2, Outlook 2013 SP1, Outlook 2013 RT SP1, and Outlook 2016 as packaged in Microsoft Office allows an information…
CVE-2017-8545 - CVSS 6.5 (medium), 2017-06-15: A spoofing vulnerability exists in when Microsoft Outlook for Mac does not sanitize html properly, aka "Microsoft Outlook for Mac Spoofing Vulnerability".
CVE-2017-8507 - CVSS 7.8 (high), 2017-06-15: A remote code execution vulnerability exists in the way Microsoft Office software parses specially crafted email messages, aka "Microsoft Office Memory…
CVE-2017-8506 - CVSS 7.8 (high), 2017-06-15: A remote code execution vulnerability exists in Microsoft Office when the software fails to properly handle objects in memory, aka "Office Remote Code…
CVE-2017-8508 - CVSS 5.5 (medium), 2017-06-15: A security feature bypass vulnerability exists in Microsoft Office software when it improperly handles the parsing of file formats, aka "Microsoft Office…
CVE-2017-0207 - CVSS 6.5 (medium), 2017-04-12: Microsoft Outlook for Mac 2011 allows remote attackers to spoof web content via a crafted email with specific HTML tags, aka "Microsoft Browser Spoofing…
CVE-2017-0204 - CVSS 5.5 (medium), 2017-04-12: Microsoft Outlook 2007 SP3, Microsoft Outlook 2010 SP2, Microsoft Outlook 2013 SP1, and Microsoft Outlook 2016 allow remote attackers to bypass the Office…
CVE-2017-0106 - CVSS 7.8 (high), 2017-04-12: Microsoft Excel 2007 SP3, Microsoft Outlook 2010 SP2, Microsoft Outlook 2013 SP1, and Microsoft Outlook 2016 allow remote attackers to execute arbitrary code…
CVE-2016-3366 - CVSS 6.5 (medium), 2016-09-14: Microsoft Outlook 2007 SP3, Outlook 2010 SP2, Outlook 2013 SP1, Outlook 2013 RT SP1, Outlook 2016, and Outlook 2016 for Mac do not properly implement RFC…
CVE-2016-3278 - CVSS 7.8 (high), 2016-07-13: Microsoft Outlook 2010 SP2, 2013 SP1, 2013 RT SP1, and 2016 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft…
CVE-2015-1641 - CVSS 7.8 (high), 2015-04-14: Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Office Compatibility Pack SP3, Word Automation…
CVE-2013-3905 - CVSS 5 (medium), 2013-11-13: Microsoft Outlook 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT does not properly expand metadata contained in S/MIME certificates, which allows remote…
CVE-2013-3870 - CVSS 9.3 (critical), 2013-09-11: Double free vulnerability in Microsoft Outlook 2007 SP3 and 2010 SP1 and SP2 allows remote attackers to execute arbitrary code by including many nested S/MIME…
CVE-2010-2728 - CVSS 9.3 (critical), 2010-09-15: Heap-based buffer overflow in Microsoft Outlook 2002 SP3, 2003 SP3, and 2007 SP2, when Online Mode for an Exchange Server is enabled, allows remote attackers…
CVE-2010-0266 - CVSS 9.3 (critical), 2010-07-15: Microsoft Office Outlook 2002 SP3, 2003 SP3, and 2007 SP1 and SP2 does not properly verify e-mail attachments with a PR_ATTACH_METHOD property value of…
CVE-2008-3068 - CVSS 7.5 (high), 2008-07-07: Microsoft Crypto API 5.131.2600.2180 through 6.0, as used in Outlook, Windows Live Mail, and Office 2007, performs Certificate Revocation List (CRL) checks by…
CVE-2007-4040 - CVSS 8.8 (high), 2007-07-27: Argument injection vulnerability involving Microsoft Outlook and Outlook Express, when certain URIs are registered, allows remote attackers to conduct…
CVE-2007-0671 - CVSS 8.8 (high), 2007-02-03: Unspecified vulnerability in Microsoft Excel 2000, XP, 2003, and 2004 for Mac, and possibly other Office products, allows remote user-assisted attackers to…
CVE-2007-0033 - CVSS 9.3 (critical), 2007-01-09: Microsoft Outlook 2002 and 2003 allows user-assisted remote attackers to execute arbitrary code via a malformed VEVENT record in an .iCal meeting request or…
CVE-2007-0034 - CVSS 9.3 (critical), 2007-01-09: Buffer overflow in the Advanced Search (Finder.exe) feature of Microsoft Outlook 2000, 2002, and 2003 allows user-assisted remote attackers to execute…
CVE-2006-1305 - CVSS 4.3 (medium), 2006-12-31: Microsoft Outlook 2000, 2002, and 2003 allows user-assisted remote attackers to cause a denial of service (memory exhaustion and interrupted mail recovery)…
CVE-2006-6659 - CVSS 5 (medium), 2006-12-20: The Microsoft Office Outlook Recipient ActiveX control (ole32.dll) in Windows XP SP2 allows remote attackers to cause a denial of service (Internet Explorer 7…
CVE-2006-3877 - CVSS 9.3 (critical), 2006-10-10: Unspecified vulnerability in PowerPoint in Microsoft Office 2000, Office 2002, Office 2003, Office 2004 for Mac, and Office v.X for Mac allows user-assisted…
CVE-2006-4868 - CVSS 9.3 (critical), 2006-09-19: Stack-based buffer overflow in the Vector Graphics Rendering engine (vgx.dll), as used in Microsoft Outlook and Internet Explorer 6.0 on Windows XP SP2, and…
CVE-2006-2055 - CVSS 5 (medium), 2006-04-26: Argument injection vulnerability in Microsoft Outlook 2003 SP1 allows user-assisted remote attackers to modify command line arguments to an invoked mail…
CVE-2006-0002 - CVSS 7.5 (high), 2006-01-10: Unspecified vulnerability in Microsoft Outlook 2000 through 2003, Exchange 5.0 Server SP2 and 5.5 SP4, Exchange 2000 SP3, and Office allows remote attackers…
CVE-2005-1052 - CVSS 5 (medium), 2005-05-02: Microsoft Outlook 2003 and Outlook Web Access (OWA) 2003 do not properly display comma separated addresses in the From field in an e-mail message, which could…
CVE-2004-2482 - CVSS 5 (medium), 2004-12-31: Microsoft Outlook 2000 and 2003, when configured to use Microsoft Word 2000 or 2003 as the e-mail editor and when forwarding e-mail, does not properly handle…
CVE-2004-0284 - CVSS 5 (medium), 2004-11-23: Microsoft Internet Explorer 6.0, Outlook 2002, and Outlook 2003 allow remote attackers to cause a denial of service (CPU consumption), if "Do not save…
CVE-2004-0200 - CVSS 9.3 (critical), 2004-09-28: Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to…
CVE-2004-0501 - CVSS 5 (medium), 2004-08-18: Outlook 2003 allows remote attackers to bypass intended access restrictions and cause Outlook to request a URL from a remote site via an HTML e-mail message…
CVE-2004-0503 - CVSS 5 (medium), 2004-08-18: Microsoft Outlook 2003 allows remote attackers to bypass the default zone restrictions and execute script within media files via a Rich Text Format (RTF)…
CVE-2004-0502 - CVSS 5 (medium), 2004-08-18: Outlook 2003, when replying to an e-mail message, stores certain files in a predictable location for the "src" of an img tag of the original message, which…
CVE-2004-0526 - CVSS 5 (medium), 2004-08-06: Unknown versions of Internet Explorer and Outlook allow remote attackers to spoof a legitimate URL in the status bar via A HREF tags with modified "alt"…
CVE-2004-0204 - CVSS 7.5 (high), 2004-08-06: Directory traversal vulnerability in the web viewers for Business Objects Crystal Reports 9 and 10, and Crystal Enterprise 9 or 10, as used in Visual Studio…