PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-30103 Microsoft CVE debrief

CVE-2024-30103 is a high-severity remote code execution vulnerability in Microsoft Outlook, published by NVD on June 11, 2024, with a CVSS 3.1 score of 8.8. The vulnerability affects multiple Microsoft Office and Outlook versions, including Microsoft 365 Apps for Enterprise (x64 and x86), Office 2019 (x64 and x86), Office LTSC 2021 (x64 and x86), and Outlook 2016 (x64 and x86). The attack vector is network-based with low attack complexity, requiring low privileges but no user interaction, and can result in high impacts to confidentiality, integrity, and availability. Microsoft has released patches and vendor guidance to address this vulnerability. The CVE record was last modified on May 19, 2026. This vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities catalog.

Vendor
Microsoft
Product
Microsoft Office 2019
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2024-06-11
Original CVE updated
2026-05-19
Advisory published
2024-06-11
Advisory updated
2026-05-19

Who should care

Organizations running Microsoft Outlook 2016, Office 2019, Office LTSC 2021, or Microsoft 365 Apps for Enterprise; security teams responsible for email client security; IT administrators managing Office patch deployments; compliance officers tracking critical vulnerability remediation timelines

Technical summary

This vulnerability allows remote code execution in Microsoft Outlook through a flaw related to incomplete validation of disallowed inputs (CWE-184). The network-accessible attack surface, combined with low complexity and no required user interaction, creates significant risk for enterprise environments. Successful exploitation grants attackers high-level access to system confidentiality, integrity, and availability. Multiple Office product lines share affected codebases, requiring comprehensive patching across deployment footprints.

Defensive priority

high

Recommended defensive actions

  • Apply Microsoft security updates for affected Office and Outlook versions as detailed in the Microsoft Security Response Center advisory
  • Prioritize patching for systems where Outlook is used with network-accessible configurations or where users have elevated privileges
  • Review and restrict unnecessary network exposure of Outlook client systems
  • Monitor for anomalous Outlook process behavior or unexpected network connections from Office applications
  • Ensure Microsoft 365 Apps, Office 2019, Office LTSC 2021, and Outlook 2016 installations are updated to patched versions
  • Consider implementing application control policies to restrict unauthorized code execution within Office applications

Evidence notes

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Weaknesses identified include CWE-184 (Incomplete List of Disallowed Inputs) per Microsoft, with NVD noting NVD-CWE-Other.

Official resources

Microsoft disclosed this vulnerability through its Security Response Center with coordinated patch release.