CVE Watch10 ago 2026

CVE-2024-21413

Microsoft Outlook Improper Input Validation Vulnerability

CVSS

9.8

Crítico

EPSS

94.7%

p100

KEV

SÍ

6 feb 2025

Exploit Today

0-100

Publicado: 13 feb 2024 · Última mod.: 10 ago 2026 · CWE-20

EPSS · 30d

94.7%EPSS · 30 días94.7%

2026-09-162026-10-14

Ficha del catálogo KEV

Producto

Microsoft / Office Outlook

Vulnerabilidad

Microsoft Outlook Improper Input Validation Vulnerability

Añadido a KEV

6 feb 2025

Remediar antes de

27 feb 2025

Uso conocido en ransomware

Descripción resumida

Microsoft Outlook contains an improper input validation vulnerability that allows for remote code execution. Successful exploitation of this vulnerability would allow an attacker to bypass the Office Protected View and open in editing mode rather than protected mode.

Acción requerida

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notas

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21413 ; https://nvd.nist.gov/vuln/detail/CVE-2024-21413

Descripción técnica

Microsoft Outlook Remote Code Execution Vulnerability

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-798218.2 ALT

—

———A security vulnerability in HPE NonStop SOAP 4.0 may cause memory corruption resulting in a system down.6h CVE-2026-766617.6 ALT

—

———A vulnerability in HPE NonStop QIOMON allows an out-of-bounds write that can corrupt buffer data.11h CVE-2026-766608.7 ALT

—

———A vulnerability in HPE NonStop CIPSAM allows an out-of-bounds write that can corrupt buffer data.11h CVE-2026-1108705.3 MED

—

——0Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a parenthesized comment in the domain, so illegal characters reach envelope.to and RCPT TO, causing rejected delivery or parser interpretation conflicts that bypass domain allow-lists.14h CVE-2026-732617.5 ALT

—

——0Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TCP/IP stack enabled by MG_ENABLE_TCPIP in src/net_builtin.c does not reject a TCP option whose declared opts[1] length exceeds the remaining option bytes. In handle_opt(), a NOP followed by a truncated MSS option causes opts[3] to be read outside the declared options area and used as the low byte of dmss. An unauthenticated remote peer can corrupt the per-connection MSS value so later mg_send() calls transmit truncated or zero-length application payloads while the TCP connection otherwise appears healthy. This issue is fixed in version 7.23.18h CVE-2026-539997.7 ALT

—

——0Radius is a cloud-native, portable application platform that makes app development easier for teams building cloud-native apps. Prior to 0.58.0, the Kubernetes controller deserializes the user-controlled radapp.io/status annotation on a Deployment and uses its container resource identifier for deletion without confirming ownership by that Deployment. An attacker with permission to modify Deployment annotations and knowledge of a target Radius resource ID can forge radapp.io/status and set radapp.io/enabled to false, causing reconciliation to enter the privileged deletion path for another tenant's Radius-managed container resource. In a multi-tenant installation this confused-deputy condition can delete another team's recoverable container resource and disrupt service; in a single-tenant installation the impact is limited to self denial of service. The multi-tenant Radius controller reads the annotations in pkg/controller/reconciler/annotations.go and reaches the privileged delete in pkg/controller/reconciler/deployment_reconciler.go. The issue does not disclose data, grant privileges, or provide persistence. This issue is fixed in version 0.58.0.17h