In May 2025, Microsoft addressed a significant security flaw in its Outlook email client, identified as CVE-2025-32705, during its Patch Tuesday updates. This vulnerability, with a CVSSv3 score of 7.8, arises from an out-of-bounds read error due to improper memory handling in Outlook. An attacker can exploit this flaw by sending a specially crafted file to a target user. If the user opens this malicious file in an affected version of Microsoft Outlook, the error is triggered, allowing the attacker to execute arbitrary code on the local system. This could lead to complete system compromise, data theft, or further malware deployment. Notably, the Outlook Preview Pane is not an attack vector for this vulnerability; the user must actively open the malicious file for the attack to succeed.
Critical Microsoft Outlook Vulnerability Enables Remote Code Execution
