Loading story…
Microsoft’s June 2024 security updates fixed 51 vulnerabilities across its product portfolio, including 18 remote code execution flaws, with the most severe issue tracked as CVE-2024-30080 in Microsoft Message Queuing (MSMQ). The vulnerability is a use-after-free bug rated CVSS 9.8 that can allow unauthenticated remote code execution through a specially crafted MSMQ packet on systems where MSMQ is enabled, making exposed or internally reachable MSMQ services a high-priority patching target.
The same release also addressed CVE-2024-30103, a Microsoft Outlook vulnerability rated CVSS 8.8 that can bypass the Outlook registry blacklist and lead to code execution in the context of the targeted user. Reporting on the flaw described it as a zero-click issue that can be triggered when an email is opened, increasing the risk to enterprise email users even without obvious interaction. Microsoft’s advisories indicated the flaws were fixed in the June release, and external reporting said they were not known to be actively exploited at publication, though researchers signaled plans to publish proof-of-concept code for the Outlook bug.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
Morphisec released a blog post analyzing CVE-2024-30103 and describing it as a critical Microsoft Outlook vulnerability that executes when an email is opened. The post provided additional technical discussion of the flaw after Microsoft's disclosure.
Microsoft published details for CVE-2024-30103, an Outlook vulnerability that can bypass the Outlook registry blacklist and lead to authenticated remote code execution in the victim user's context. CSIRT.SK described it as a zero-click issue that can be triggered when an email is opened.
Microsoft documented CVE-2024-30080 as a critical use-after-free vulnerability in Microsoft Message Queuing. The flaw allows unauthenticated remote code execution via a specially crafted MSMQ packet on systems where MSMQ is enabled.
Microsoft issued its June 2024 security updates addressing 51 vulnerabilities across its products. The release included fixes for CVE-2024-30080 in MSMQ and CVE-2024-30103 in Outlook.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
blog.morphisec.com
Open sourcecsirt.sk
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft has released fixes for multiple **critical Microsoft Office, Word, and Outlook Classic vulnerabilities** that can lead to remote code execution when a victim opens or previews a specially crafted file or email. The affected flaws include Office bugs **CVE-2025-49695**, **CVE-2025-49696**, **CVE-2025-49697**, **CVE-2025-49699**, **CVE-2025-49702**, Word bug **CVE-2025-49698**, and newer Outlook/Word rendering issues **CVE-2026-45456**, **CVE-2026-45458**, and **CVE-2026-47635**. Microsoft described the bugs as stemming from memory-safety issues such as **use-after-free**, **heap-based buffer overflow**, **type confusion**, and **out-of-bounds read**, with several carrying **CVSS 8.4** ratings. In multiple cases, Microsoft said the **Preview Pane** can trigger exploitation, and some flaws may be exploited without additional user interaction once malicious content is rendered. Microsoft said the vulnerable code paths affect Office and Word components, including the **Word rendering engine** used by **Outlook Classic**, and that supported builds such as **Microsoft Office LTSC 2024** and Mac Office LTSC channels received updates, with some Mac patches arriving later. Most of the 2025 flaws were not publicly disclosed or exploited at publication, though Microsoft assessed some as **more likely** to be exploited; the 2026 Outlook and Word issues similarly prompted urgent patching guidance because remotely delivered email content can trigger local processing and code execution. Microsoft urged organizations to install all applicable updates and strengthen defenses around Office email handling, including **Protected View**, **Attack Surface Reduction** rules, and monitoring for suspicious Office child-process activity.
Jun 29, 2026
Microsoft released June 2026 security updates that include fixes for three critical remote code execution vulnerabilities in Outlook and Word: `CVE-2026-45456`, `CVE-2026-45458`, and `CVE-2026-47635`. The flaws were described as memory-safety issues in the Word rendering engine, which Outlook Classic uses to render email content, creating a **no-click** attack path through the Outlook Preview Pane. Microsoft assigned each issue a CVSS score of **8.4** and said no active exploitation had been observed at the time of disclosure. The vulnerabilities affect supported Microsoft Office and Outlook builds, including Office LTSC 2024, and were addressed as part of Microsoft’s June Patch Tuesday releases highlighted by multiple security advisories. Reporting on the updates urged organizations to prioritize patch deployment, especially for systems running Outlook Classic and Word, and to consider temporary risk reduction measures such as disabling the Preview Pane in high-risk environments while monitoring for suspicious Office-related process activity.
Jul 7, 2026
Microsoft released security updates for **Microsoft Message Queuing (MSMQ)** to address three disclosed vulnerabilities affecting the Windows messaging component. The issues include **`CVE-2024-49122`**, a **remote code execution** flaw, alongside **`CVE-2025-21181`** and **`CVE-2025-21289`**, both classified as **denial-of-service** vulnerabilities in MSMQ. The advisories indicate that organizations running systems with MSMQ enabled should review Microsoft's Security Update Guide entries and apply the relevant patches to reduce the risk of service disruption or potential code execution. The combination of one RCE bug and two DoS flaws highlights continued security exposure in MSMQ, a legacy Windows feature that may remain active in enterprise environments even when it is not widely used.
Jul 12, 2026