Read the docs
TI-2019-00923 Aliases CVE-2019-1200GHSA-89v5-wvp7-3m8g

Microsoft Outlook Remote Code Execution Vulnerability

Priority MEDIUM 42Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could use a specially crafted file to perform actions in the security context of the current user. For example, the file could then take actions on behalf of the logged-on user with the same permissions as the current user. To exploit the vulnerability, a user must open a specially crafted file with an affected version of Microsoft Outlook software. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted file that is designed to exploit the vulnerability. However, an attacker would have no way to force the user to visit the website. Instead, an attacker would have to convince the user to click a link, typically by way of an enticement in an email or Instant Messenger message, and then convince the user to open the specially crafted file. Note that the Preview Pane is not an attack vector for this vulnerability. The security update addresses the vulnerability by correcting how Microsoft Outlook handles files in memory.

Why it matters now

EPSS 0.04646 91st percentileScored 2026-11-07
Fix Fixed Microsoft Office 2019 (Microsoft): https://aka.ms/OfficeSecurityReleasesOffice 365 ProPlus (Microsoft): publication+3 more products

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftMicrosoft Office 201919.0.0 to before https://aka.ms/OfficeSecurityReleaseshttps://aka.ms/OfficeSecurityReleasesPatch availableCNA
MicrosoftOffice 365 ProPlus16.0.0 to before publicationpublicationPatch availableCNA
MicrosoftMicrosoft Outlook 201616.0.0.0 to before publicationpublicationPatch availableCNA
MicrosoftMicrosoft Outlook 2013 Service Pack 115.0.0.0 to before publicationpublicationPatch availableCNA
MicrosoftMicrosoft Outlook 2010 Service Pack 213.0.0.0 to before publicationpublicationPatch availableCNA
  • Microsoft Office 2019 VendorMicrosoft Affected 19.0.0 to before https://aka.ms/OfficeSecurityReleases Fixed in https://aka.ms/OfficeSecurityReleases Patch available CNA
  • Office 365 ProPlus VendorMicrosoft Affected 16.0.0 to before publication Fixed in publication Patch available CNA
  • Microsoft Outlook 2016 VendorMicrosoft Affected 16.0.0.0 to before publication Fixed in publication Patch available CNA
  • Microsoft Outlook 2013 Service Pack 1 VendorMicrosoft Affected 15.0.0.0 to before publication Fixed in publication Patch available CNA
  • Microsoft Outlook 2010 Service Pack 2 VendorMicrosoft Affected 13.0.0.0 to before publication Fixed in publication Patch available CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:*:*2019VulnerableMicrosoft
cpe:2.3:a:microsoft:office_365_proplus:-:*:*:*:*:*:*:*not specified by NVDVulnerableMicrosoft
cpe:2.3:a:microsoft:outlook:2010:sp2:*:*:*:*:*:*2010 sp2VulnerableMicrosoft
cpe:2.3:a:microsoft:outlook:2013:sp1:*:*:*:*:*:*2013 sp1VulnerableMicrosoft
cpe:2.3:a:microsoft:outlook:2013:sp1:*:*:rt:*:*:*2013 sp1VulnerableMicrosoft
cpe:2.3:a:microsoft:outlook:2016:*:*:*:*:*:*:*2016VulnerableMicrosoft
  • cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:*:* Versions 2019 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:office_365_proplus:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:outlook:2010:sp2:*:*:*:*:*:* Versions 2010 sp2 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:outlook:2013:sp1:*:*:*:*:*:* Versions 2013 sp1 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:outlook:2013:sp1:*:*:rt:*:*:* Versions 2013 sp1 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:outlook:2016:*:*:*:*:*:*:* Versions 2016 Vulnerable ·Microsoft

Remediation

  • Fix · CNA Microsoft Office 2019 (Microsoft) Fixed in https://aka.ms/OfficeSecurityReleases
  • Fix · CNA Office 365 ProPlus (Microsoft) Fixed in publication
  • Fix · CNA Microsoft Outlook 2016 (Microsoft) Fixed in publication
  • Fix · CNA Microsoft Outlook 2013 Service Pack 1 (Microsoft) Fixed in publication
  • Fix · CNA Microsoft Outlook 2010 Service Pack 2 (Microsoft) Fixed in publication

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-1200
  2. 2026-10-03 Alias added: GHSA-89v5-wvp7-3m8g

References

Patch 1

  • TI-2023-09240 Microsoft Outlook Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-01013 A remote code execution vulnerability exists in Microsoft Excel software when the… KEVCVSS 3.1HIGH 8.8
  • TI-2019-00335 Command injection in Microsoft Office KEVCVSS 3.1HIGH 8.8
  • TI-2018-00739 Out-of-bounds write in Microsoft Equation Editor KEVCVSS 3.1HIGH 8.8
  • TI-2015-02130 Microsoft PowerPoint 2007 SP3, Word 2007 SP3, PowerPoint 2010 SP2, Word 2010 SP2… KEVCVSS 3.1HIGH 8.8
  • TI-2015-01588 Microsoft Office 2013 SP1 and 2013 RT SP1 allows remote attackers to execute arbitrary… KEVCVSS 3.1HIGH 8.8
See all 1024 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences