Medium

Microsoft Outlook Information Disclosure Vulnerability

IdentifiersCVE-2017-8572CWE-200· Exposure of Sensitive Information…

A Microsoft Outlook information disclosure issue affecting Outlook 2007 SP3, Outlook 2010 SP2, Outlook 2013 SP1, Outlook 2013 RT SP1, and Outlook 2016 as packaged in Microsoft Office. According to the provided content, crafted HTML email content could cause Outlook to disclose memory contents, and related research showed Outlook could also be abused to initiate outbound SMB or WebDAV requests when a victim opened or previewed a malicious email. NCC Group documented multiple HTML elements and URI schemes that could trigger remote resource access from the reading pane under default settings, including cases where external images were blocked. Microsoft partially addressed the issue in July 2017 under CVE-2017-8572, with additional payload coverage later associated with CVE-2017-11927 and a subsequent May 2018 update.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can disclose sensitive information from the victim environment. Based on the supporting content, this included outbound authentication material such as SMB hashes that could be captured by an attacker for offline password cracking, as well as remote-request side effects that allowed tracking whether a target opened or previewed an email. In practical phishing and red-team scenarios, this could expose user and administrator hashes and facilitate credential theft, reconnaissance, and follow-on compromise.

Mitigation

If you can’t patch tonight, do this now.

Where patching is not immediately possible, reduce exposure by reading email in plain text, disabling the preview/reading pane where operationally feasible, deleting unknown or untrusted emails without opening them, and blocking outbound SMB ports 445 and 139 at host and network boundaries. Use Windows Firewall controls and apply Restrict NTLM policies where appropriate. Note that blocking 445/139 may reduce SMB hash theft but, per the provided content, does not fully prevent DNS or WebDAV-based tracking behavior.

Remediation

Patch, then assume compromise.

Apply Microsoft's security updates for CVE-2017-8572 and subsequent related fixes, including the later payload coverage referenced in CVE-2017-11927 and the May 2018 update described in the supporting content. Ensure affected Outlook versions are fully patched rather than relying only on the initial July 2017 partial fix.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Microsoft CorporationOutlookapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

soroushNews

Aug 13, 2018

SMB hash hijacking & user tracking in MS Outlook

A Microsoft Outlook issue that could be abused to trigger external SMB/WebDAV requests when an email was opened or viewed, potentially leaking SMB hashes or enabling email-view tracking. CVE-2017-8572 is described as a partial patch for this issue.

ncc group researchNews

May 11, 2018

SMB hash hijacking & user tracking in MS Outlook

A Microsoft Outlook issue where crafted HTML emails could trigger external SMB/WebDAV requests when opened or previewed, enabling SMB hash leakage or email-view tracking; this CVE is described as a partial patch for the issue.

soroush secprojectNews

May 26, 2026

A Microsoft Outlook vulnerability related to SMB hash hijacking and user tracking via crafted HTML email content that could trigger external SMB/WebDAV requests when an email was opened or previewed.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity