CVE-2023-36895: Microsoft Outlook RCE Vulnerability

CVE-2023-36895 Overview

CVE-2023-36895 is a remote code execution vulnerability in Microsoft Outlook tracked under [CWE-416] use-after-free. The flaw affects multiple Microsoft Office product lines, including Microsoft 365 Apps, Office 2013 through 2019, and Office Long Term Servicing Channel 2021. An attacker who successfully exploits the issue can execute arbitrary code in the context of the current user. Exploitation requires a local attack vector and user interaction, typically by convincing a target to open a malicious file. Microsoft published the advisory on August 8, 2023, and assigned it a CVSS v3.1 base score of 7.8.

Critical Impact
Successful exploitation grants the attacker code execution with the privileges of the signed-in Outlook user, enabling data theft, persistence, and lateral movement.

Affected Products

Microsoft 365 Apps for Enterprise (x86 and x64)
Microsoft Office 2013 SP1, Office 2016, and Office 2019 (Windows and macOS)
Microsoft Office Long Term Servicing Channel 2021 (Windows and macOS)

Discovery Timeline

2023-08-08 - CVE-2023-36895 published to NVD with Microsoft advisory
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-36895

Vulnerability Analysis

The vulnerability is classified as a use-after-free condition [CWE-416] in Microsoft Outlook. Use-after-free issues occur when a program continues to reference memory that has been released back to the allocator. An attacker who controls allocation patterns can place attacker-controlled data into the freed region. When Outlook later dereferences the stale pointer, the corrupted object can redirect execution flow to attacker-controlled code.

Microsoft categorizes the impact as remote code execution despite the local attack vector classification. The local vector reflects that the malicious content must reach the victim's Outlook client and be opened by the user. Confidentiality, integrity, and availability impacts are all rated high because successful exploitation runs arbitrary code as the logged-on user.

Root Cause

The root cause is improper object lifetime management within Outlook's message or attachment handling code paths. A specific code path frees an object while retaining a pointer that is later reused. Microsoft has not published low-level technical detail beyond the use-after-free classification in the Microsoft CVE-2023-36895 Advisory.

Attack Vector

The attacker crafts a malicious Office document or email payload and delivers it through phishing, file sharing, or web download. The victim opens the file in a vulnerable Outlook client. Outlook parses the content, triggers the use-after-free condition, and pivots execution into attacker-controlled memory. No authentication is required on the attacker side, and exploitation does not need elevated privileges on the victim host.

No public proof-of-concept exploit is listed in the enriched data, and the vulnerability is not on the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.664% at the 71st percentile, indicating moderate predicted exploitation likelihood relative to other CVEs.

Detection Methods for CVE-2023-36895

Indicators of Compromise

Outlook process (OUTLOOK.EXE) spawning unexpected child processes such as cmd.exe, powershell.exe, wscript.exe, or rundll32.exe
Unsigned or unusual DLLs loaded into the Outlook process address space
Outbound network connections initiated by Outlook to non-Microsoft infrastructure shortly after opening a message or attachment
Crash dumps for OUTLOOK.EXE referencing access violations on freed heap chunks

Detection Strategies

Hunt for parent-child process anomalies where Office applications launch scripting or LOLBin executables
Monitor for suspicious file writes from Outlook into %APPDATA%, %TEMP%, or Startup folder locations
Correlate Outlook crashes from Windows Error Reporting with subsequent process or persistence activity on the same host

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction rules that block Office child process creation and credential theft from LSASS
Forward Sysmon process, image load, and network connect events to your SIEM for retroactive hunting
Track Office build numbers across the fleet and alert when hosts fall behind the patched baseline from August 2023 Patch Tuesday

How to Mitigate CVE-2023-36895

Immediate Actions Required

Apply the August 2023 security updates for all affected Microsoft Office channels referenced in the Microsoft CVE-2023-36895 Advisory
Inventory endpoints running Office 2013 SP1, 2016, 2019, 365 Apps, and LTSC 2021 to confirm patch deployment status
Enforce Protected View and block macros from internet-sourced documents through Group Policy

Patch Information

Microsoft addressed CVE-2023-36895 in the August 8, 2023 security update release. Administrators should consult the Microsoft Security Response Center advisory for the specific KB articles and build numbers that correspond to each Office channel and platform. Click-to-Run installations of Microsoft 365 Apps update automatically when connected; volume-licensed and MSI-based installations require manual KB deployment through standard patch management tooling.

Workarounds

Read email in plain text format to reduce parsing of rich content that may trigger the flaw
Restrict email attachments at the secure email gateway, blocking high-risk Office document types from untrusted senders
Apply application control policies (Windows Defender Application Control or AppLocker) to prevent Outlook from launching unauthorized child processes

bash

# Configuration example: enable ASR rule blocking Office child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled