Critical RCE in Microsoft Outlook (CVE‑2024‑21413) Bypasses Protected View
What It Is — Microsoft Outlook fails to properly validate crafted input, allowing an attacker to execute arbitrary code on the victim machine. Successful exploitation lets the adversary bypass Office Protected View and open malicious documents directly in edit mode.
Exploitability — Publicly disclosed by CISA’s Known Exploited Vulnerabilities (KEV) catalog; proof‑of‑concept code is available and the vulnerability is actively exploited in the wild. CVSS v3.1 base score: 8.8 (High).
Affected Products — Microsoft Outlook 2016, 2019, 2021, and Microsoft 365 (desktop client) on Windows.
Why It Matters for Trust & Control Assurance
- Demonstrates a gap in application control and secure configuration that must be continuously monitored to prove due diligence.
- A successful exploit erodes the audit trail for document handling, making it harder to demonstrate compliance with control objectives around protecting data in use.
- Enterprises that can provide defensible evidence of timely patching and configuration validation gain a stronger trust signal with partners and regulators.
Recommended Actions
- Deploy Microsoft’s security update for CVE‑2024‑21413 immediately across all Outlook installations.
- Enforce application‑allow‑list policies that block execution of unsigned Office components.
- Enable and monitor Windows Event Logging for
Microsoft‑Office‑Protection‑Viewbypass events. - Update your control‑mapping inventory to reflect the patched state and capture evidence for audit purposes.
- Conduct a rapid risk assessment to identify any data that may have been exposed through prior exploitation.
Source: CISA KEV – CVE‑2024‑21413