CVE-2024-21413
Microsoft Outlook Improper Input Validation Vulnerability
Description
CVE-2024-21413 is a critical remote code execution vulnerability in Microsoft Outlook, commonly referred to as the "MonikerLink" bug. The flaw allows an unauthenticated attacker to execute arbitrary code remotely by sending a specially crafted email that exploits how Outlook processes certain hyperlinks. With a CVSS v3.1 base score of 9.8 and an exceptionally high EPSS score of 93.47% at the 99th percentile, this is one of the most dangerous and actively exploited Outlook vulnerabilities in recent years. CISA has added CVE-2024-21413 to the Known Exploited Vulnerabilities catalog with a remediation deadline of February 27, 2025, and public exploit code is available.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | 365 apps | - |
| microsoft | office 2016 | - |
| microsoft | office 2019 | - |
| microsoft | office long term servicing channel | 2021 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21413(Patch, Vendor Advisory)
- https://research.checkpoint.com/2024/the-risks-of-the-monikerlink-bug-in-microsoft-outlook-and-the-big-picture/(Technical Description)
- https://www.vicarius.io/vsociety/posts/cve-2024-21413-critical-monikerlink-vulnerability-affecting-microsoft-outlook-detection-script(Exploit)
- https://www.vicarius.io/vsociety/posts/cve-2024-21413-critical-monikerlink-vulnerability-affecting-microsoft-outlook-mitigation-script(Mitigation)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21413(US Government Resource)
Weakness Type
Improper Link Handling (MonikerLink)
CVE-2024-21413 arises from improper handling of specific hyperlink types in Microsoft Outlook. While no specific CWE has been formally assigned, the vulnerability is related to how Outlook processes moniker links — a type of COM (Component Object Model) link that can reference external resources. When Outlook encounters a specially crafted hyperlink containing a moniker reference, it bypasses the Protected View security mechanism and processes the link in a way that can lead to NTLM credential leakage and arbitrary code execution. The flaw effectively circumvents Outlook's built-in security protections that are designed to prevent automatic execution of external content from emails.
Impact Analysis
CVE-2024-21413 poses an extreme risk to any organization using Microsoft Outlook or Microsoft Office products. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) represents the most severe combination: exploitable over the network, low complexity, no authentication, no user interaction, with maximum impact across all security dimensions. Confidentiality (High): The vulnerability can leak NTLM authentication hashes to attacker-controlled servers, enabling offline password cracking or NTLM relay attacks. Full remote code execution further allows the attacker to access all data available to the user, including emails, contacts, calendar entries, and files accessible from the compromised system. Integrity (High): Arbitrary code execution allows the attacker to install malware, modify files, alter system configurations, create persistent backdoors, forge emails, and manipulate any data within the user's access scope. The attacker can also use the compromised system to send phishing emails to the victim's contacts, leveraging established trust relationships. Availability (High): The attacker can encrypt files for ransomware, crash applications, disrupt system operations, or render the compromised workstation inoperable. The EPSS score of 93.47% at the 99th percentile is exceptionally high, indicating that this is among the most actively targeted vulnerabilities globally. Ransomware association is currently listed as unknown, but the combination of remote code execution through email with no user interaction makes this a prime vector for ransomware delivery.
Exploit Maturity
CVE-2024-21413 demonstrates maximum exploit maturity with confirmed active exploitation and publicly available exploit code. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild with a mandatory remediation deadline of February 27, 2025. Public exploit code is available, including a detection script on vSociety and a mitigation script. Check Point Research published a detailed technical analysis of the MonikerLink vulnerability, providing in-depth information about the exploitation mechanism. The EPSS score of 93.47% at the 99th percentile places this among the very top tier of exploited vulnerabilities worldwide, indicating widespread, active targeting by multiple threat actor groups. The zero-click nature of the exploit (no user interaction required in the Preview Pane) and the ubiquity of Microsoft Outlook in enterprise environments make this exceptionally dangerous. Ransomware association is currently listed as unknown.
Remediation
-
Apply Microsoft security updates immediately. Microsoft released patches for CVE-2024-21413 through the Microsoft Security Response Center. Install the applicable updates for all affected products: Microsoft 365 Apps, Office 2016, Office 2019, and Office LTSC 2021. Prioritize this patch across the entire organization given the critical severity and active exploitation.
-
Verify Protected View and security settings are enforced. Ensure that Microsoft Outlook and Office Protected View settings are enabled and not bypassed by organizational Group Policy. Configure Office to block external content by default and restrict macro execution. Review and tighten Outlook security settings to minimize the attack surface for email-borne exploits.
-
Implement email security controls. Deploy email gateway security solutions that can detect and quarantine emails containing suspicious moniker links or malicious hyperlink patterns associated with CVE-2024-21413. Enable advanced threat protection features in Microsoft 365 (Microsoft Defender for Office 365) or equivalent third-party solutions to scan and detonate suspicious email content before delivery.
-
Block outbound NTLM authentication to external servers. Configure network-level controls to prevent NTLM authentication requests from reaching external servers, as the vulnerability can be used to leak NTLM hashes. Implement firewall rules blocking outbound SMB (TCP 445) and other NTLM-capable protocols to untrusted destinations. Consider deploying EPA (Extended Protection for Authentication) and restricting NTLM usage via Group Policy.
-
Monitor for indicators of compromise. Review email gateway logs for emails containing unusual hyperlink formats, particularly those with moniker link patterns. Check endpoint detection logs for anomalous Outlook behavior, unexpected outbound SMB connections, and signs of code execution triggered by email processing. Investigate any NTLM relay activity or unauthorized authentication attempts originating from workstations.
Technical Details
CVE-2024-21413 is a remote code execution vulnerability in Microsoft Outlook known as the "MonikerLink" bug. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects the maximum severity: network-exploitable, no authentication needed, no user interaction required, with full impact on confidentiality, integrity, and availability. The vulnerability exploits how Microsoft Outlook handles specific types of hyperlinks embedded in emails. When Outlook processes a hyperlink containing a COM moniker reference (a specially formatted link that references Component Object Model objects), it bypasses the Protected View sandbox that normally prevents automatic execution of external content. The attack leverages the "file://" protocol handler in combination with an exclamation mark syntax that triggers moniker link processing, causing Outlook to follow the link and initiate an SMB connection to an attacker-controlled server. This connection leaks the victim's NTLM authentication hash without any user interaction — even previewing the email in Outlook's Reading Pane is sufficient to trigger the vulnerability. Beyond NTLM credential theft, the moniker link mechanism can be further abused to load remote COM objects, enabling arbitrary code execution on the victim's system. The vulnerability affects Microsoft 365 Apps for Enterprise, Office 2016, Office 2019, and Office Long Term Servicing Channel 2021, covering the vast majority of enterprise Outlook deployments. The zero-click exploitation through the Preview Pane makes this particularly dangerous in environments where users receive external emails.
Frequently Asked Questions
Is CVE-2024-21413 being actively exploited?
Yes. CISA has confirmed active exploitation in the wild by adding CVE-2024-21413 to the Known Exploited Vulnerabilities catalog with a remediation deadline of February 27, 2025. The EPSS score of 93.47% at the 99th percentile places this among the most actively exploited vulnerabilities globally, with public exploit code and detailed technical analysis readily available.
Can CVE-2024-21413 be triggered without user interaction?
Yes. The vulnerability can be triggered simply by previewing a malicious email in Outlook's Reading Pane — the user does not need to click any links or open any attachments. This zero-click characteristic makes it exceptionally dangerous, as receiving a crafted email is sufficient for exploitation.
What Microsoft products are affected by CVE-2024-21413?
CVE-2024-21413 affects Microsoft 365 Apps for Enterprise, Microsoft Office 2016, Microsoft Office 2019, and Microsoft Office Long Term Servicing Channel 2021. All versions of Outlook included in these product suites are vulnerable until patched.
What is the MonikerLink bug?
The MonikerLink bug refers to the mechanism by which CVE-2024-21413 is exploited. It involves specially crafted hyperlinks in emails that use COM moniker references to bypass Outlook's Protected View security. When processed, these links force Outlook to initiate connections to attacker-controlled servers, leaking NTLM credentials and potentially enabling remote code execution without any user interaction.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.