Loading vulnerability…
MonikerLink
MonikerLink is an improper input validation vulnerability in Microsoft Outlook for Windows affecting Office 2016, Office 2019, Office LTSC 2021, and Microsoft 365 Apps for Enterprise before the applicable security updates. Outlook incorrectly handles specially crafted remote file-protocol hyperlinks containing an exclamation mark and trailing text, interpreting them as composite COM monikers. Resolving these links through MkParseDisplayName bypasses normal restrictions on remote resource access and can trigger SMB authentication, exposing NTLM challenge-response material. Moniker resolution can also launch an Office application such as Word as a background COM server to parse attacker-controlled documents without Protected View. This creates a route to arbitrary code execution when combined with an exploitable document-parsing vulnerability. Outlook Web Application is not affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exploitation can disclose a user's NTLM challenge-response material, commonly NTLMv2, and expose attacker-controlled Office documents to parsing outside Protected View. Captured authentication material may support NTLM relay attacks where target services lack suitable relay protections. A successful code-execution chain runs with the logged-in user's privileges, potentially enabling data theft, modification or deletion, malware installation, and disruption. Administrative or SYSTEM privileges are not inherently granted by this vulnerability.
If you can’t patch tonight, do this now.
Until updates are deployed, block outbound SMB traffic over TCP port 445 to untrusted networks, including from roaming endpoints, to reduce NTLM authentication leakage. Restrict NTLM use and enable appropriate NTLM relay protections on destination services. Filter or detect malicious moniker-style hyperlinks in email, and use email-security or IPS protections specifically covering CVE-2024-21413. These controls reduce exposure but do not eliminate the underlying Protected View bypass or replace patching.
Patch, then assume compromise.
Install Microsoft's security updates released on February 13, 2024, or superseding updates, for every affected Office installation. Apply the update appropriate to the Office edition, architecture, and servicing channel, including Office 2016, Office 2019, Office LTSC 2021, and Microsoft 365 Apps for Enterprise. Verify deployment and confirm that installed builds meet Microsoft's fixed-version guidance.
20 exploits validated by Mallory's analysis. Hidden: 16 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
24 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.