Microsoft Outlook 8.5 and earlier, and Outlook Express 5 and earlier, with the "Automatically put people I reply to in my address book" opti

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• microsoft outlook2000
• microsoft outlook97
• microsoft outlook98
• microsoft outlook express4.0
• microsoft outlook express4.27.3110
• microsoft outlook express4.5
• microsoft outlook express4.72.2106
• microsoft outlook express4.72.3120.0
• microsoft outlook express4.72.3612
• microsoft outlook express5.0
• microsoft outlook express5.5

Other highest-scoring records for the same primary product.

• CVE-2017-11774Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary commands, due to how MicrosKEV
  79This week
• CVE-2001-0538Microsoft Outlook View ActiveX Control in Microsoft Outlook 2002 and earlier allows remote attackers to execute arbitrary commands via a mal
  56Plan
• CVE-2010-0266Microsoft Office Outlook 2002 SP3, 2003 SP3, and 2007 SP1 and SP2 does not properly verify e-mail attachments with a PR_ATTACH_METHOD proper
  54Plan
• CVE-2013-3870Double free vulnerability in Microsoft Outlook 2007 SP3 and 2010 SP1 and SP2 allows remote attackers to execute arbitrary code by including
  43Plan
• CVE-2010-2728Heap-based buffer overflow in Microsoft Outlook 2002 SP3, 2003 SP3, and 2007 SP2, when Online Mode for an Exchange Server is enabled, allows
  42Plan
• CVE-2017-0106Microsoft Excel 2007 SP3, Microsoft Outlook 2010 SP2, Microsoft Outlook 2013 SP1, and Microsoft Outlook 2016 allow remote attackers to execu
  40Plan

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.