Loading vulnerability…
CVE-2024-21378 is an authenticated remote code execution vulnerability in Microsoft Outlook caused by unsafe handling of synced custom form objects during form installation. Outlook processes form metadata and attachments delivered through MAPI form synchronization and uses attacker-controlled properties to determine message class, COM registration data, and attachment extraction behavior. Research associated with the vulnerability showed that this installation logic could be abused to achieve an arbitrary file write to the local Outlook forms directory and arbitrary registry key creation under HKEY_CLASSES_ROOT, including registration of a COM object that points to an attacker-controlled DLL. A denylist intended to block dangerous COM registration paths could be bypassed, allowing Outlook to register and subsequently load the malicious DLL when the crafted form is triggered. Trigger conditions can include normal Outlook client actions such as previewing, forwarding, or printing the malicious form in the Windows thick client.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository provides a proof-of-concept exploit for CVE-2024-21378, a vulnerability in Microsoft Outlook (Exchange Online) that allows arbitrary code execution via malicious COM DLLs. The exploit consists of a single Python script (CVE-2024-21378.py) and a README with detailed instructions. The script sends a crafted HTTP POST request to the /ruler endpoint of a target Outlook/Exchange Online instance, delivering a malicious COM DLL as a form attachment. The attack requires a valid access token (typically obtained via phishing/vishing), the target's email address, and a compiled malicious DLL. User interaction in the Outlook thick client is required to trigger the payload, which results in the DLL being loaded and executed in the Outlook process. The repository is structured simply, with the Python script as the main entry point and the README providing context, usage instructions, and a disclaimer.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Microsoft Outlook remote code execution vulnerability involving custom MAPI forms loading a malicious DLL from the FORMS directory.
A Microsoft Outlook remote code execution vulnerability referenced in connection with this detection content.
An authenticated remote code execution vulnerability in Microsoft Outlook involving malicious form objects and registry changes tied to InProcServer32 Outlook form installations.
A remote code execution vulnerability in Microsoft Outlook confirmed by Black Basta to be effective in production environments.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.