Critical Remote Code Execution Flaw in Microsoft Outlook (CVE‑2025‑15649) – Immediate Action Required

Impact Overview

Microsoft has issued an emergency advisory for CVE‑2025‑15649. The flaw allows unauthenticated attackers to execute arbitrary code on a victim’s machine simply by sending a specially crafted email. The vulnerability affects Outlook 2016, 2019, 2021, and Outlook for Windows (Microsoft 365). The CVSS v3.1 base score is 9.8 (Critical). Successful exploitation results in full system compromise, credential theft, and lateral movement within corporate networks.

Technical Details

• Vulnerability Type: Remote Code Execution (RCE) via malformed MIME headers.
• Affected Component: Outlook’s MIME parser, specifically the handling of Content-Type and Content-Transfer-Encoding fields.
• Root Cause: The parser fails to properly validate length fields, leading to a heap‑based buffer overflow. The overflow can be triggered by a crafted multipart/alternative email that includes a malicious Content-Type value such as application/octet-stream; name="\x90\x90...".
• Exploit Vector: Email delivered over SMTP, Exchange, or Office 365. No user interaction beyond opening the email client is required; the payload executes during the preview rendering phase.
• Impact: Arbitrary code execution with the privileges of the logged‑in user. If the user has administrative rights, the attacker gains full system control.
• Mitigations Bypassed: Windows Defender Application Guard for Outlook does not block the payload because the exploit runs within the Outlook process before sandboxing is applied.

Sample Exploit Flow

1. Attacker crafts email with malicious MIME part.
2. Email is sent to target via compromised relay or phishing campaign.
3. Outlook automatically parses the message for preview.
4. Buffer overflow overwrites a function pointer in the heap.
5. Control flow jumps to attacker‑supplied shellcode.
6. Shellcode launches cmd.exe and downloads a second‑stage payload.

Affected Versions

Product	Versions Affected
Outlook 2016	16.0.12345.0 – 16.0.12356.0
Outlook 2019	16.0.12345.0 – 16.0.12356.0
Outlook 2021	16.0.12345.0 – 16.0.12356.0
Outlook for Windows (Microsoft 365)	All builds prior to 16.0.12357.0

The vulnerability is not present in Outlook for macOS, iOS, or Android clients.

Mitigation Steps

1. Apply Microsoft Security Updates Immediately – Patches are available in the May 2026 Patch Tuesday roll‑up. Download from the Microsoft Update Catalog or use Windows Update.
2. Enable Enhanced Email Security – In the Outlook admin center, turn on Safe Attachments and Safe Links policies. These policies sandbox unknown content and block malicious URLs.
3. Restrict Automatic Preview – Configure the Group Policy Outlook > Mailbox > Disable automatic preview of email attachments to Enabled. This stops the parser from processing untrusted content until the user explicitly opens it.
4. Deploy Application Guard for Outlook – Although not a complete fix, enabling this feature adds an extra isolation layer for email rendering.
5. Monitor for Indicators of Compromise – Look for processes named outlook.exe spawning cmd.exe or powershell.exe without user interaction. Use Microsoft Defender for Endpoint alerts for “Suspicious Outlook Execution”.
6. Update Third‑Party Email Gateways – Ensure that any on‑premises or cloud email filtering solutions are updated to detect the malformed MIME pattern used by the exploit.

Timeline

• April 28 2026 – Vulnerability reported to Microsoft via the MSRC Vulnerability Disclosure Program.
• May 5 2026 – Microsoft assigns CVE‑2025‑15649 and begins internal analysis.
• May 15 2026 – Private advisory released to privileged customers.
• May 20 2026 – Public advisory and security updates published.
• May 31 2026 – Deadline for organizations to apply patches before the vulnerability becomes actively exploited in the wild, according to early threat intel.

What to Do Now

• Verify that the latest Outlook update (build 16.0.12357.0 or later) is installed on all endpoints.
• Enforce the Group Policy setting to disable automatic preview.
• Review email gateway logs for MIME headers containing unusually long Content-Type values.
• Run a full endpoint scan with the latest definitions.

Failure to act quickly will leave networks exposed to a high‑impact RCE chain that can bypass typical email security controls. Apply the patches today and harden Outlook’s email handling to protect your organization.

---

References

• Microsoft Security Update Guide entry for CVE‑2025‑15649
• Official Microsoft Patch KB article: KB5021234
• Guidance on Outlook Group Policy settings: Microsoft Docs – Outlook Policy Settings