- CISA adds an Outlook incorrect entry validation error to KEV
- Deadline for Patch is February 27, 2025
- Criminals use it for the execution of remote code
The US Cyber Security and Infrastructure Security Agency (CISA) has added a 2024 Outlook error to its catalog of known vulnerabilities, warned users of misuse of wild and give federal agencies three weeks (until February 27) to patch up or stop using The tool completely.
CVE-2024-21413 is a wrong input validation error that plagues Microsoft Outlook. It was discovered in 2024 by Check Point’s researcher Haifei Li, and got a severity of 9.8/10 (critical). Cyber criminals could create special E -mail messages, filled with a particular type of hyperlink that would allow them to run arbitrary code externally. By utilizing this vulnerability, attackers can bypass Outlook’s protected view (a feature designed to open potentially harmful files in read -only mode) and instead open malicious files in editing mode.
Microsoft patched the error at the end of 2024 and warned users that the preview pane can also be used as an attack vector. In other words, victims don’t even have to open the e -mail to get infected – to preview it in Outlook would be sufficient.
Significant risk
Vulnerability was found in various office products including Microsoft Office LTSC 2021, Microsoft 365 apps for Enterprise, Microsoft Outlook 2016 and Microsoft Office 2019.
Although there was no evidence of abuse of wild at the time the patch was released, its addition to KEV means that the vulnerability is now actively used by miscreans.
“These types of vulnerabilities are frequent attack vectors for malicious cyclists and pose significant risks to the federal business,” Cisa said.
Apart from the Outlook vulnerability, the agency added another four bugs, including a 7-zip brand on the webbypass error, a Dante Discovery Process Control error, a Cyberoamsos SQL injection error and a Sophos XG Firewall Buffer overflow error. Federal agencies have to patch all of these by March 2025.
