CVE-2024-21413

Microsoft Outlook mishandles hyperlinks that use the `file://` moniker scheme. By inserting an exclamation mark and text after the path in a crafted link, an attacker sidesteps Outlook's Protected View, so clicking the link causes Outlook to reach out to an attacker-controlled SMB server. That outbound authentication leaks the user's NTLM credentials and, in the right configuration, allows remote code execution — all from a link inside an email, with the Preview Pane alone being a viable trigger vector.

The exposure is enormous simply because Outlook is on nearly every corporate desktop, and this flaw — publicly dubbed MonikerLink — turns ordinary email into both a credential-harvesting and code-execution channel. Leaked NTLM hashes feed relay and offline-cracking attacks, giving an intruder a path from a single opened message toward broader network access. Apply the Microsoft patch across all affected Office and Microsoft 365 builds, and reinforce it at the network layer by blocking outbound SMB (ports 445 and 139) to the internet so the credential-leak channel is closed even where a message slips through. User awareness helps but is not a substitute for the patch.