Filtered by vendor Microsoft Subscriptions
Filtered by product Outlook Subscriptions
Total 122 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2000-0415 1 Microsoft 2 Outlook, Outlook Express 2026-04-16 N/A
Buffer overflow in Outlook Express 4.x allows attackers to cause a denial of service via a mail or news message that has a .jpg or .bmp attachment with a long file name.
CVE-2002-0481 1 Microsoft 1 Outlook 2026-04-16 N/A
An interaction between Windows Media Player (WMP) and Outlook 2002 allows remote attackers to bypass Outlook security settings and execute Javascript via an IFRAME in an HTML email message that references .WMS (Windows Media Skin) or other WMP media files, whose onload handlers execute the player.LaunchURL() Javascript function.
CVE-2001-0145 1 Microsoft 2 Outlook, Outlook Express 2026-04-16 N/A
Buffer overflow in VCard handler in Outlook 2000 and 98, and Outlook Express 5.x, allows an attacker to execute arbitrary commands via a malformed vCard birthday field.
CVE-1999-0519 1 Microsoft 4 Outlook, Windows 2000, Windows 95 and 1 more 2026-04-16 N/A
A NETBIOS/SMB share password is the default, null, or missing.
CVE-2005-1052 1 Microsoft 2 Outlook, Outlook Web Access 2026-04-16 N/A
Microsoft Outlook 2003 and Outlook Web Access (OWA) 2003 do not properly display comma separated addresses in the From field in an e-mail message, which could allow remote attackers to spoof e-mail addresses.
CVE-1999-1164 1 Microsoft 2 Outlook, Outlook Express 2026-04-16 N/A
Microsoft Outlook client allows remote attackers to cause a denial of service by sending multiple email messages with the same X-UIDL headers, which causes Outlook to hang.
CVE-2006-4868 1 Microsoft 5 Internet Explorer, Outlook, Windows 2000 and 2 more 2026-04-16 N/A
Stack-based buffer overflow in the Vector Graphics Rendering engine (vgx.dll), as used in Microsoft Outlook and Internet Explorer 6.0 on Windows XP SP2, and possibly other versions, allows remote attackers to execute arbitrary code via a Vector Markup Language (VML) file with a long fill parameter within a rect tag.
CVE-2004-2482 1 Microsoft 1 Outlook 2026-04-16 N/A
Microsoft Outlook 2000 and 2003, when configured to use Microsoft Word 2000 or 2003 as the e-mail editor and when forwarding e-mail, does not properly handle an opening OBJECT tag that does not have a closing OBJECT tag, which causes Outlook to automatically download the URI in the data property of the OBJECT tag and might allow remote attackers to execute arbitrary code.
CVE-2003-1378 1 Microsoft 2 Outlook, Outlook Express 2026-04-16 N/A
Microsoft Outlook Express 6.0 and Outlook 2000, with the security zone set to Internet Zone, allows remote attackers to execute arbitrary programs via an HTML email with the CODEBASE parameter set to the program, a vulnerability similar to CAN-2002-0077.
CVE-2004-0502 1 Microsoft 1 Outlook 2026-04-16 N/A
Outlook 2003, when replying to an e-mail message, stores certain files in a predictable location for the "src" of an img tag of the original message, which allows remote attackers to bypass zone restrictions and exploit other issues that rely on predictable locations, as demonstrated using a shell: URI.
CVE-2002-1056 1 Microsoft 2 Outlook, Word 2026-04-16 N/A
Microsoft Outlook 2000 and 2002, when configured to use Microsoft Word as the email editor, does not block scripts that are used while editing email messages in HTML or Rich Text Format (RTF), which could allow remote attackers to execute arbitrary scripts via an email that the user forwards or replies to.
CVE-2000-0756 1 Microsoft 1 Outlook 2026-04-16 N/A
Microsoft Outlook 2000 does not properly process long or malformed fields in vCard (.vcf) files, which allows attackers to cause a denial of service.
CVE-2000-0160 1 Microsoft 3 Ie, Internet Explorer, Outlook 2026-04-16 N/A
The Microsoft Active Setup ActiveX component in Internet Explorer 4.x and 5.x allows a remote attacker to install software components without prompting the user by stating that the software's manufacturer is Microsoft.
CVE-2026-21260 1 Microsoft 11 365 Apps, Office, Office 2019 and 8 more 2026-04-15 7.5 High
Exposure of sensitive information to an unauthorized actor in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-26133 1 Microsoft 35 365 Copilot, 365 Copilot Android, 365 Copilot For Android and 32 more 2026-04-14 7.1 High
AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.
CVE-2025-21357 1 Microsoft 8 365 Apps, Office, Office 2019 and 5 more 2026-02-26 6.7 Medium
Microsoft Outlook Remote Code Execution Vulnerability
CVE-2025-49699 1 Microsoft 14 365 Apps, Office, Office 2019 and 11 more 2026-02-26 7 High
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
CVE-2025-47171 1 Microsoft 9 365 Apps, Office, Office 2019 and 6 more 2026-02-26 6.7 Medium
Improper input validation in Microsoft Office Outlook allows an authorized attacker to execute code locally.
CVE-2025-47176 1 Microsoft 5 365 Apps, Office, Office 2024 and 2 more 2026-02-26 7.8 High
'.../...//' in Microsoft Office Outlook allows an authorized attacker to execute code locally.
CVE-2020-1493 1 Microsoft 3 365 Apps, Office, Outlook 2026-02-23 5.5 Medium
An information disclosure vulnerability exists when attaching files to Outlook messages. This vulnerability could potentially allow users to share attached files such that they are accessible by anonymous users where they should be restricted to specific users. To exploit this vulnerability, an attacker would have to attach a file as a link to an email. The email could then be shared with individuals that should not have access to the files, ignoring the default organizational setting. The security update addresses the vulnerability by correcting how Outlook handles file attachment links.