OU
Email
Outlook
On CISA KEVExploited in the wild
125
CVEs
5
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 44Medium 32Low 0
Watch
Add Outlook to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-23397 In wildKEV | 9.8 | Mar 14 | Microsoft Outlook Elevation of Privilege Vulnerability Affected: 2013; 2013; 2016 |
| CVE-2023-35311 In wildKEV | 8.8 | Jul 11 | Microsoft Outlook Security Feature Bypass Vulnerability Affected: 2013; 2013; 2016 |
| CVE-2007-0671 In wildKEV | 8.8 | Feb 3 | Microsoft Office Excel Remote Code Execution Vulnerability Affected: 2000; 2002; 2003 |
| CVE-2017-11774 In wildKEV | 7.8 | Oct 13 | Microsoft Office Outlook Security Feature Bypass Vulnerability Affected: Microsoft Outlook 2010 SP2; Outlook 2013 SP1 and RT SP1; Outlook 2016 |
| CVE-2015-1641 In wildKEV | 7.8 | Apr 14 | Microsoft Office Memory Corruption Vulnerability Affected: 2011 |
| CVE-2024-42220 | 9.1 | Dec 18 | A library injection vulnerability exists in Microsoft Outlook 16.83.3 for macOS Affected: 16.83.3 for macOS |
| CVE-2026-78519 | 8.8 | Sep 8 | Microsoft Office Outlook Remote Code Execution Vulnerability Affected: 2016; 2016 |
| CVE-2026-69629 | 8.8 | Sep 8 | Microsoft Office Outlook Remote Code Execution Vulnerability Affected: 2016; 2016 |
| CVE-2026-70329 | 8.8 | Aug 11 | Microsoft Outlook Remote Code Execution Vulnerability Affected: 2016; 2016 |
| CVE-2024-30103 | 8.8 | Jun 11 | Microsoft Outlook Remote Code Execution Vulnerability Affected: 2016; 2016 |
| CVE-2024-21378 | 8.8 | Feb 13 | Microsoft Outlook Remote Code Execution Vulnerability Affected: 2016 |
| CVE-2023-33131 | 8.8 | Jun 14 | Microsoft Outlook Remote Code Execution Vulnerability Affected: 2013; 2013; 2016; 2016 |
| CVE-2020-0760 | 8.8 | Apr 15 | A remote code execution vulnerability exists when Microsoft Office improperly loads arbitrary type libraries, aka 'Microsoft Office Remote Code Execution Vulnerability' Affected: 2010; 2013; 2013; 2016 |
| CVE-2018-8582 | 8.8 | Nov 14 | A remote code execution vulnerability exists in the way that Microsoft Outlook parses specially modified rule export files, aka "Microsoft Outlook Remote Code Execution… Affected: 2010; 2013; 2016 |
| CVE-2018-0852 | 8.8 | Feb 15 | Microsoft Outlook 2007 SP3, Microsoft Outlook 2010 SP2, Microsoft Outlook 2013 SP1 and RT SP1, Microsoft Outlook 2016, and Microsoft Office 2016 Click-to-Run (C2R) allow a remote… Affected: 2010; 2013; 2013; 2016 |
| CVE-2018-0851 | 8.8 | Feb 15 | Microsoft Office 2007 SP2, Microsoft Office Word Viewer, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1 and RT SP1, Microsoft Office 2016, and Microsoft Office 2016… Affected: 2010; 2013; 2013; 2016 |
| CVE-2007-4040 | 8.8 | Jul 27 | Argument injection vulnerability involving Microsoft Outlook and Outlook Express, when certain URIs are registered, allows remote attackers to conduct cross-browser scripting… Affected: All versions, or not specified |
| CVE-2024-20670 | 8.1 | Apr 9 | Outlook for Windows Spoofing Vulnerability Affected: before 1.2023.0322.0100 |
| CVE-2024-43604 | 8.0 | Oct 8 | Outlook for Android Elevation of Privilege Vulnerability Affected: 2016 |
| CVE-2025-21361 | 7.8 | Jan 14 | Microsoft Outlook Remote Code Execution Vulnerability Affected: before 16.93 |
| CVE-2021-31941 | 7.8 | Jun 8 | Microsoft Office Graphics Remote Code Execution Vulnerability Affected: 2013 |
| CVE-2020-1349 | 7.8 | Jul 14 | A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory, aka 'Microsoft Outlook Remote Code Execution… Affected: 2010; 2013; 2013; 2016 |
| CVE-2019-1200 | 7.8 | Aug 14 | A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory Affected: 2010; 2013; 2013; 2016 |
| CVE-2018-8576 | 7.8 | Nov 14 | A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory, aka "Microsoft Outlook Remote Code Execution… Affected: 2010; 2013; 2013; 2016 |
| CVE-2018-8524 | 7.8 | Nov 14 | A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory, aka "Microsoft Outlook Remote Code Execution… Affected: 2010; 2013; 2016 |
| CVE-2018-8522 | 7.8 | Nov 14 | A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory, aka "Microsoft Outlook Remote Code Execution… Affected: 2010; 2013; 2016 |
| CVE-2018-0791 | 7.8 | Jan 10 | Microsoft Outlook 2007, Microsoft Outlook 2010, Microsoft Outlook 2013, and Microsoft Outlook 2016 allow a remote code execution vulnerability due to the way email messages are… Affected: 2007; 2010; 2013; 2013; 2016 |
| CVE-2017-8663 | 7.8 | Aug 1 | Microsoft Outlook 2007 SP3, Outlook 2010 SP2, Outlook 2013 SP1, Outlook 2013 RT SP1, and Outlook 2016 as packaged in Microsoft Office allows a remote code execution vulnerability… Affected: 2007; 2010; 2013; 2016 |
| CVE-2017-8571 | 7.8 | Aug 1 | Microsoft Outlook 2007 SP3, Outlook 2010 SP2, Outlook 2013 SP1, Outlook 2013 RT SP1, and Outlook 2016 as packaged in Microsoft Office allows a security feature bypass… Affected: 2007; 2010; 2013; 2016 |
| CVE-2017-8507 | 7.8 | Jun 15 | A remote code execution vulnerability exists in the way Microsoft Office software parses specially crafted email messages, aka "Microsoft Office Memory Corruption Vulnerability" Affected: 2007; 2010; 2013; 2013; 2016 |
| CVE-2017-8506 | 7.8 | Jun 15 | A remote code execution vulnerability exists in Microsoft Office when the software fails to properly handle objects in memory, aka "Office Remote Code Execution Vulnerability" Affected: 2010; 2013; 2013; 2016 |
| CVE-2017-0106 | 7.8 | Apr 12 | Microsoft Excel 2007 SP3, Microsoft Outlook 2010 SP2, Microsoft Outlook 2013 SP1, and Microsoft Outlook 2016 allow remote attackers to execute arbitrary code or cause a denial of… Affected: 2007; 2010; 2013; 2016 |
| CVE-2016-3278 | 7.8 | Jul 13 | Microsoft Outlook 2010 SP2, 2013 SP1, 2013 RT SP1, and 2016 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory… Affected: 2010; 2013; 2016 |
| CVE-2003-1048 | 7.8 | Jul 27 | Double free vulnerability in mshtml.dll for certain versions of Internet Explorer 6.x allows remote attackers to cause a denial of service (application crash) via a malformed GIF… Affected: 2000; 2000; 2000 |
| CVE-2026-42893 | 7.5 | May 12 | Microsoft Outlook for iOS Tampering Vulnerability Affected: before 5.2617.1 |
| CVE-2026-21260 | 7.5 | Feb 10 | Microsoft Outlook Spoofing Vulnerability Affected: 2016; 2016 |
| CVE-2025-29805 | 7.5 | Apr 8 | Exposure of sensitive information to an unauthorized actor in Outlook for Android allows an unauthorized attacker to disclose information over a network Affected: before 4.2509.0 |
| CVE-2024-26204 | 7.5 | Mar 12 | Outlook for Android Information Disclosure Vulnerability Affected: before 4.2404.0 |
| CVE-2023-36763 | 7.5 | Sep 12 | Microsoft Outlook Information Disclosure Vulnerability Affected: 2016; 2016 |
| CVE-2022-35742 | 7.5 | Jun 1 | Microsoft Outlook Denial of Service Vulnerability Affected: 2013; 2013; 2016 |
| CVE-2020-16947 | 7.5 | Oct 16 | <p>A remote code execution vulnerability exists in Microsoft Outlook software when the software fails to properly handle objects in memory Affected: 2016 |
| CVE-2017-11776 | 7.5 | Oct 13 | Microsoft Outlook 2016 allows an attacker to obtain the email content of a user, due to how Outlook 2016 discloses user email content, aka "Microsoft Outlook Information… Affected: 2016 |
| CVE-2021-31949 | 7.3 | Jun 8 | Microsoft Outlook Remote Code Execution Vulnerability Affected: 2013; 2013; 2016 |
| CVE-2026-26133 | 7.1 | Mar 13 | M365 Copilot Information Disclosure Vulnerability Affected: before 5.2605.0; before 5.2605.0 |
| CVE-2021-28452 | 7.1 | Apr 13 | Microsoft Outlook Memory Corruption Vulnerability Affected: 2010; 2013; 2013; 2016 |
| CVE-2025-49699 | 7.0 | Jul 8 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally Affected: 2016; 2016 |
| CVE-2025-47171 | 6.7 | Jun 10 | Improper input validation in Microsoft Office Outlook allows an authorized attacker to execute code locally Affected: 2016 |
| CVE-2025-21357 | 6.7 | Jan 14 | Microsoft Outlook Remote Code Execution Vulnerability Affected: 2016; 2016 |
| CVE-2024-38173 | 6.7 | Aug 13 | Microsoft Outlook Remote Code Execution Vulnerability Affected: 2016 |
| CVE-2026-80073 | 6.5 | Sep 8 | Microsoft Office Outlook Information Disclosure Vulnerability Affected: 2016; 2016 |
