--- title: "CVE-2024-38021: Moniker RCE Vulnerability Uncovered in Microsoft Outlook" description: Morphisec researchers have discovered an important Microsoft Outlook vulnerability. Read on for CVE-2024- 38021 details and technical impact. image: https://www.morphisec.com/hubfs/Outlook%20Moniker%20Parsing%20Vulnerability.png --- Recent Webinar: Building an Adaptive Cyber Resilient Cloud ![arrow-white](https://www.morphisec.com/hubfs/arrow-white.svg) ![arrow-white](https://www.morphisec.com/hubfs/arrow-white.svg) [![Watch now](https://no-cache.hubspot.com/cta/default/1534169/6359793e-b232-4b79-9da5-b929fc3dc7aa.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/6359793e-b232-4b79-9da5-b929fc3dc7aa) ![close](https://www.morphisec.com/hubfs/close.svg) ![search_icon](https://www.morphisec.com/hubfs/search_icon.svg) [![Morphisec-Logo](https://www.morphisec.com/hubfs/Morphisec-Logo.svg "Morphisec-Logo")](http://www.morphisec.com) ![blog](https://www.morphisec.com/hubfs/blog.svg) [![Read the Blog](https://no-cache.hubspot.com/cta/default/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360) [![Get A Demo](https://no-cache.hubspot.com/cta/default/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3) [![Morphisec-Logo](https://www.morphisec.com/hubfs/Morphisec-Logo.svg "Morphisec-Logo")](http://www.morphisec.com) ![search_icon](https://www.morphisec.com/hubfs/search_icon.svg) - ![blog](https://www.morphisec.com/hubfs/blog.svg) [![Read the Blog](https://no-cache.hubspot.com/cta/default/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360) - [![Get A Demo](https://no-cache.hubspot.com/cta/default/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3) Cybersecurity Blog Cybersecurity News, Threat Research, and more from the Team Spearheading the Evolution of Endpoint Security # CVE-2024-38021: Moniker RCE Vulnerability Uncovered in Microsoft Outlook Posted by [Michael Gorelik](https://1534169.hs-sites.com/author/michael-gorelik) on July 9, 2024 Find me on: [LinkedIn](https://www.linkedin.com/in/michael-gorelik-56130021) [Twitter ](https://twitter.com/smgoreli) - [Tweet](https://twitter.com/share) Morphisec researchers have identified a significant vulnerability, CVE-2024-38021 — a zero-click remote code execution (RCE) vulnerability that impacts most Microsoft Outlook applications.   ![Outlook Moniker Parsing Vulnerability](https://www.morphisec.com/hubfs/Outlook%20Moniker%20Parsing%20Vulnerability.png)Unlike the previously [discovered vulnerability CVE-2024-30103](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-30103) disclosed in June —which required authentication (at least an NTLM token)— this new vulnerability does not require any authentication.    ## CVE-2024-38021 Vulnerability Details and Technical Impact If exploited, CVE-2024-38021 can lead to potential data breaches, unauthorized access, and other malicious activities.  Microsoft has assessed this vulnerability with an "Important" severity rating. Their assessment differentiates between trusted and untrusted senders, noting that while the vulnerability is zero-click for trusted senders, it requires one click user interaction for untrusted senders.  Given the broader implications of this vulnerability, particularly its zero-click vector for trusted senders and its potential for much wider spread impact, we have requested Microsoft to reassess the severity and label it as "Critical." This reassessment is crucial to reflect the true risk and ensure adequate attention and resources are allocated for mitigation. The complexity for this RCE is higher than [CVE-2024-30103](https://blog.morphisec.com/cve-2024-30103-microsoft-outlook-vulnerability), reducing the likelihood of short-term exploitation. However, the chaining of this vulnerability with another could potentially simplify the attack process.    ## Timeline of Events **April 21, 2024:** The vulnerability was initially reported to Microsoft by Morphisec researchers as part of responsible disclosure policy.   **April 26, 2024:** The vulnerability was confirmed.   **July 9, 2024:** Microsoft included a patch for CVE-2024-38021 as part of its [Patch Tuesday updates](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-38021).   We commend Microsoft for addressing this vulnerability relatively quickly, especially considering its problematic nature and the complexity of the previous patch.  [![New call-to-action](https://no-cache.hubspot.com/cta/default/1534169/8fcef7be-a943-4617-a8f0-6387b82ffeeb.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/8fcef7be-a943-4617-a8f0-6387b82ffeeb)    ## **Exploitation Risk**  Given its zero-click nature (for trusted senders) and lack of authentication requirements, CVE-2024-38021 poses a severe risk. Attackers could exploit this vulnerability to gain unauthorized access, execute arbitrary code, and cause substantial damage without any user interaction. The absence of authentication requirements makes it particularly dangerous, as it opens the door to widespread exploitation.     ## **Patch Release and Urgent Call to Action**  **Patch Deployment:** Ensure that all Microsoft Outlook and Office applications are updated with the latest patches as soon as they are available.  **Email Security:** Implement robust email security measures, including disabling automatic email previews if possible.  **User Awareness**: Educate users about the risks associated with opening emails from unknown or suspicious sources.  Ensuring optimal and comprehensive coverage across the security stack with EDR and Automated Moving Target Defense (AMTD) reduces further risk and will offer endpoint assurance against known and unknown attacks.    ## **Research and Discovery Process**  Morphisec’s research involved extensive fuzzing and reverse engineering of Microsoft Outlook's codebase to identify the specific conditions that led to the discovery of this Microsoft Outlook vulnerability. The findings were then thoroughly documented and reported to Microsoft (as per responsible disclosure process), ensuring a collaborative approach to addressing the issue.    ## **Technical Details and Proof of Concept**  The Morphisec Threat Labs team presented their technical findings about [CVE-2024-30103](https://1534169.hs-sites.com/cve-2024-30103-technical-analysis) and CVE-2024-38021 on the main stage at DEF CON 32. If you weren't able to attend in person, watch the [on-demand webinar](https://engage.morphisec.com/outlook-unleashing-rce-chaos) to hear directly from those that discovered these vulnerabilities and to learn more about the vulnerabilities. [Watch now](https://engage.morphisec.com/outlook-unleashing-rce-chaos)[.](https://engage.morphisec.com/outlook-unleashing-rce-chaos)  [![Watch On-Demand: Microsoft Outlook Chaos Webinar](https://no-cache.hubspot.com/cta/default/1534169/40d5b46a-ce48-42ef-8281-12ae60f3e796.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/40d5b46a-ce48-42ef-8281-12ae60f3e796)   ## **How Morphisec can Help**  At Morphisec, we utilize Automated Moving Target Defense (AMTD) techniques to significantly reduce the risk of exploitation from vulnerabilities like CVE-2024-38021. By continuously and dynamically altering the attack surface, Morphisec AMTD creates a highly challenging environment for potential attackers. This innovative and preventative approach strengthens the protection of our clients against a broad spectrum of sophisticated cyber threats.  Additionally, Morphisec’s AMTD technology acts as a virtual patch and compensating control for unpatched vulnerabilities. It proactively thwarts attacks on unpatched operating systems and application vulnerabilities by disrupting attack pathways, effectively dismantling an attacker’s framework.   Experience Morphisec firsthand — schedule a demo today.   [![New call-to-action](https://no-cache.hubspot.com/cta/default/1534169/a5d9e888-01ef-4e83-9c65-fdccb3682891.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/a5d9e888-01ef-4e83-9c65-fdccb3682891) ### Subscribe to our blog Stay in the loop with industry insight, cyber security trends, and cyber attack information and company updates. [![New call-to-action](https://no-cache.hubspot.com/cta/default/1534169/e098d357-1710-4cfe-8901-19c93de122f4.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/e098d357-1710-4cfe-8901-19c93de122f4) ### Search Our Site ### Recent Posts ### Posts by Tag - [Automated Moving Target Defense (157)](https://1534169.hs-sites.com/topic/automated-moving-target-defense) - [Threat Research (135)](https://1534169.hs-sites.com/topic/threat-research) - [Cyber Security News (132)](https://1534169.hs-sites.com/topic/cyber-security-news) - [Morphisec Labs (127)](https://1534169.hs-sites.com/topic/morphisec-labs) - [Morphisec News (54)](https://1534169.hs-sites.com/topic/morphisec-news) - [Adaptive Exposure Management (14)](https://1534169.hs-sites.com/topic/adaptive-exposure-management) - [Defense-in-Depth (13)](https://1534169.hs-sites.com/topic/defense-in-depth) - [Ransomware (12)](https://1534169.hs-sites.com/topic/ransomware) - [Preemptive Security (11)](https://1534169.hs-sites.com/topic/preemptive-security) - [Gartner (10)](https://1534169.hs-sites.com/topic/gartner) - [Continuous Threat Exposure Management (CTEM) (9)](https://1534169.hs-sites.com/topic/continuous-threat-exposure-management-ctem) - [Microsoft (8)](https://1534169.hs-sites.com/topic/microsoft) - [In-Memory Attacks (7)](https://1534169.hs-sites.com/topic/in-memory-attacks) - [Healthcare Cybersecurity (6)](https://1534169.hs-sites.com/topic/healthcare-cybersecurity) - [Advanced Threat Defense (5)](https://1534169.hs-sites.com/topic/advanced-threat-defense) - [Financial Cybersecurity (5)](https://1534169.hs-sites.com/topic/financial-cybersecurity) - [Legacy Security (5)](https://1534169.hs-sites.com/topic/legacy-security) - [Artificial Intelligence (4)](https://1534169.hs-sites.com/topic/artificial-intelligence) - [Linux Cybersecurity (4)](https://1534169.hs-sites.com/topic/linux-cybersecurity) - [Fileless Malware (3)](https://1534169.hs-sites.com/topic/fileless-malware) - [Threat and Vulnerability Management (2)](https://1534169.hs-sites.com/topic/threat-and-vulnerability-management) - [Managed Service Providers (1)](https://1534169.hs-sites.com/topic/managed-service-providers) [See all](https://1534169.hs-sites.com/cve-2024-38021-microsoft-outlook-moniker-rce-vulnerability#) - [![X](https://1534169.hs-sites.com/hubfs/x_twitter_icon.svg)](https://twitter.com/morphisec) - [![Linkedin](https://1534169.hs-sites.com/hubfs/linkedin_icon.svg)](https://www.linkedin.com/company/morphisec) - [![Youtube](https://1534169.hs-sites.com/hubfs/youtube_icon.svg)](https://www.youtube.com/channel/UCe48cR5xTxPJSYMjG-So7Rw) © 2026 Morphisec Ltd. | All rights reserved ![iso27001-(2)](https://www.morphisec.com/hubfs/iso27001-(2).png) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Michael Gorelik", "url" : "https://1534169.hs-sites.com/author/michael-gorelik" }, "dateModified" : "2024-08-15T19:34:45.843Z", "datePublished" : "2024-07-09T18:20:00.000Z", "headline" : "CVE-2024-38021: Moniker RCE Vulnerability Uncovered in Microsoft Outlook", "image" : [ "https://www.morphisec.com/hubfs/Outlook%20Moniker%20Parsing%20Vulnerability.png" ], "mainEntityOfPage" : { "@id" : "https://1534169.hs-sites.com/cve-2024-38021-microsoft-outlook-moniker-rce-vulnerability", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://www.morphisec.com/hubfs/morphisec-logo-color-horz.png" }, "name" : "Morphisec" } } ```