EUVD-2025-17723CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionNVD
'.../...//' in Microsoft Office Outlook allows an authorized attacker to execute code locally.
AnalysisAI
Local code execution vulnerability in Microsoft Office Outlook triggered by improper path traversal handling (CWE-35) in the '.../...//' sequence. Authorized users with local access can exploit this to execute arbitrary code with the privileges of the Outlook process, achieving high confidentiality, integrity, and availability impact. This vulnerability requires local access and existing user privileges but no user interaction, making it a significant risk for multi-user systems or compromised local accounts.
Technical ContextAI
This vulnerability exploits improper canonicalization of file paths in Microsoft Office Outlook. The CWE-35 classification (Path Traversal - Improper Limitation of a Pathname to a Restricted Directory) indicates that the application fails to properly validate or normalize path inputs containing sequences like '.../...//', which can be used to access files outside intended directories. The Outlook email client processes file paths during attachment handling, embedded content resolution, or local file access operations. The path traversal sequence bypasses directory restrictions, allowing an attacker to specify arbitrary file system locations. This is likely triggered through crafted email content, calendar invites, or contact data that Outlook parses and processes without adequate path sanitization.
RemediationAI
- Apply Microsoft security patch when released (monitor Microsoft Security Update Guide and MSRC advisories). 2. Immediate workaround: Restrict local system access to Outlook processes; disable Outlook add-ins from untrusted sources. 3. For multi-user systems, enforce principle of least privilege to reduce accounts capable of triggering the vulnerability. 4. Monitor for exploitation attempts targeting path traversal sequences in Outlook logs. 5. Consider disabling Outlook preview pane if email sources are untrusted, as attachment rendering may trigger parsing. 6. Update to latest Office version once patched version is confirmed available.
More from same product – last 7 days
Remote code execution in Microsoft Azure Orbital Spatio allows unauthenticated network attackers to upload dangerous fil
Unsafe deserialization in Microsoft Planetary Computer Pro (Geocatalog) lets a remote unauthenticated attacker craft mal
Remote code execution in Microsoft Power Pages allows unauthenticated network attackers to inject and execute operating-
Privilege elevation in Microsoft Azure Resource Manager (ARM) allows remote unauthenticated attackers to bypass authenti
Privilege escalation in Microsoft Entra ID enables remote unauthenticated attackers to bypass origin validation and gain
Share
External POC / Exploit Code
Leaving vuln.today