“There are at least two more confirmed CVEs that have yet to be patched, (both of) which lead to full NTLM [Network Trust Level Manager] compromise, so the risk is still there,” Gorelik told CSO Online on Wednesday. 

The hole, which Microsoft has dubbed CVE-2024-38173, allows any email malware to be activated without the recipient opening the message, courtesy of Outlook’s popular email preview function. But even for those who are not using mail preview, the malware is still likely to be activated, as most corporate employees would likely open those messages. They know to not open an unknown attachment or click on an unexpected link, but this attack methodology requires neither of those actions.

“The discovery of CVE-2024-38173 highlights a critical flaw in the form-based architecture of Outlook, where an attacker with access to an account can craft and propagate a malicious form that evades detection due to a faulty deny list implementation,” Gorelik said.