{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3amicrosoftoffice_ltsc2021/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:microsoft:outlook:2016:*:*:*:*:*:*:*","cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:*:*","cpe:2.3:a:microsoft:office_ltsc:2021:*:*:*:*:*:*:*","cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:*:*","cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2024-21378"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Microsoft 365 Apps","Microsoft Office 2019","Microsoft Office Long Term Servicing Channel 2021","Microsoft Outlook 2016"],"_cs_severities":["high"],"_cs_tags":["remote-code-execution","outlook","office","windows","exploitation"],"_cs_type":"advisory","_cs_vendors":["Microsoft"],"content_html":"\u003cp\u003eCVE-2024-21378 is a remote code execution (RCE) vulnerability affecting Microsoft Outlook, specifically within the handling of Exchange Online COM DLLs. The vulnerability allows an attacker to achieve code execution on a victim machine when a user interacts with a specially crafted email form. Proof-of-concept exploit code has been publicly released, detailing the use of a modified version of the 'Ruler' tool to facilitate the delivery of these malicious forms. The vulnerability is rated with a CVSS score of 8.8, reflecting its potential for significant impact on confidentiality, integrity, and availability. Successful exploitation requires an attacker to first obtain access to an Exchange Online mailbox, typically via credential theft or device code-based authentication bypass.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker performs initial reconnaissance to identify a target mailbox.\u003c/li\u003e\n\u003cli\u003eThe attacker harvests authentication tokens via phishing or device code-based social engineering.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious COM-compatible DLL containing the desired malicious payload.\u003c/li\u003e\n\u003cli\u003eThe attacker configures a modified 'Ruler' tool to package the DLL within a custom Outlook form.\u003c/li\u003e\n\u003cli\u003eThe attacker uses the compromised access tokens to send the malicious form to the victim's mailbox via Exchange Online.\u003c/li\u003e\n\u003cli\u003eThe victim opens or interacts with the malicious email form within the Outlook desktop client.\u003c/li\u003e\n\u003cli\u003eOutlook loads the malicious COM DLL from the form, resulting in arbitrary code execution within the context of the Outlook process.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary code execution on systems running Microsoft 365 Apps, Microsoft Office 2019, Microsoft Office LTSC 2021, and Microsoft Outlook 2016. An attacker achieving this could gain full control over the user's workstation, exfiltrate sensitive data, or move laterally within the organization's network. The availability of public PoC code significantly increases the likelihood of exploitation attempts against unpatched environments.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003ePrioritize the application of security patches provided by Microsoft for the affected Office and Outlook versions to remediate CVE-2024-21378.\u003c/li\u003e\n\u003cli\u003eImplement phishing-resistant multi-factor authentication (MFA) to prevent the token theft required for the initial access stage.\u003c/li\u003e\n\u003cli\u003eMonitor Outlook process activity for unexpected DLL loads or child process creation indicative of malicious COM interaction.\u003c/li\u003e\n\u003cli\u003eRestrict the ability of external or untrusted users to send custom forms or modify mailbox settings that facilitate form delivery.\u003c/li\u003e\n\u003cli\u003eRestrict the use of legacy tools or scripts (e.g., Ruler) that communicate directly with Exchange Online/Graph API from non-sanctioned systems.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-12T18:28:40Z","date_published":"2026-10-12T18:28:40Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2024-21378/","summary":"CVE-2024-21378 is a remote code execution vulnerability in Microsoft Outlook that enables attackers to execute arbitrary code by delivering a malicious email form containing a COM DLL.","title":"Remote Code Execution in Microsoft Outlook via CVE-2024-21378","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2024-21378/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:microsoft:office_ltsc:2021:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}