- A vulnerability in Microsoft Outlook allowed threat actors to distribute malware via email
- The bug abuses the Windows Object Linking and Embedding feature
- A patch is already available and users are advised to apply it ASAP
Microsoft has released a patch for a critical vulnerability that allowed threat actors to distribute malware through its Outlook email client — and given the severity of the flaw, users are advised to install the patch immediately.
In a security advisory, Microsoft described CVE-2025-21298, a no-use-after-free vulnerability, with a severity score of 9.8/10 (Critical). Use after free is a vulnerability where threat actors are able to use previously freed memory, which allows them to corrupt valid data, or in this scenario – distribute malware remotely.
Located in the Windows Object Linking and Embedding (OLE) feature, the flaw means that just seeing a malicious email in the preview pane is enough to get the endpoint infected with malware. Windows OLE is a technology that makes it possible to embed and link to documents and other objects. For example, users can embed an Excel chart in a Word document, and updates to the Excel file will reflect in the Word document if they are linked.
Specially designed emails
“In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted email to the victim,” Microsoft explained in the announcement.
“Exploitation of the vulnerability could involve a victim either opening a specially crafted email with an affected version of Microsoft Outlook software or a victim’s Outlook application displaying a preview of a specially crafted email. This could result in , that the attacker executes remote code on the victim’s machine.”
For those who cannot apply the patch immediately, Microsoft suggests a number of restrictions, including viewing emails as plain text and, in large LANs, limiting NTLM traffic or disabling it entirely. Displaying emails as plain text means that other multimedia such as images, animations or other fonts will not be displayed.
However, it’s worth the trouble, as the malware sent this way can cause serious business disruption, loss of customers and possibly even regulatory fines.
Via NotebookCheck
