CVE-2024-26204: Microsoft Outlook Information Disclosure

CVE-2024-26204 Overview

CVE-2024-26204 is an information disclosure vulnerability affecting Microsoft Outlook for Android. Microsoft published the advisory on March 12, 2024. The flaw is categorized under [CWE-77] (Improper Neutralization of Special Elements used in a Command) and allows an unauthenticated remote attacker to access confidential information processed by the mobile mail client. Exploitation does not require user interaction or prior authentication. The issue impacts the confidentiality of data handled by Outlook for Android, including mailbox content and account context. Microsoft has issued a fix through its standard mobile app update channel for Android.

Critical Impact

Unauthenticated attackers can disclose sensitive information from Outlook for Android over the network without user interaction.

Affected Products

• Microsoft Outlook for Android (prior to the patched release)
• Android devices running vulnerable Outlook builds distributed via Google Play
• Enterprise mobile deployments using Outlook for Android with Microsoft 365 accounts

Discovery Timeline

• 2024-03-12 - CVE-2024-26204 published to NVD
• 2024-03-12 - Microsoft released the security advisory and patched build
• 2025-01-15 - Last updated in NVD database

Technical Details for CVE-2024-26204

Vulnerability Analysis

CVE-2024-26204 is an information disclosure issue in Outlook for Android. The CWE mapping to [CWE-77] indicates that the root cause involves improper neutralization of special elements within a command-style input handled by the application. An attacker who can reach the vulnerable code path over the network can recover information that should remain confidential. The advisory indicates no integrity or availability impact, meaning the flaw exposes data but does not modify mailbox contents or disrupt service. The EPSS value places it among vulnerabilities with above-average likelihood of exploit activity, reinforcing the priority of patching mobile fleets.

Root Cause

The vulnerability stems from improper handling of command-related input within Outlook for Android. According to the [CWE-77] mapping, the application does not adequately neutralize special elements before they are used in a command context. This allows crafted input to alter how the client processes a request, causing the application to disclose data that should be inaccessible to the requester.

Attack Vector

The attack vector is network-based with low complexity and no privileges required. An attacker delivers a crafted message or request that the Outlook for Android client processes. Because user interaction is not required, exploitation can be triggered by inbound content reaching the mailbox. The result is unauthorized disclosure of confidential information held or rendered by the client.

No public proof-of-concept code or exploit module is available for CVE-2024-26204 at the time of writing. Technical specifics of the command-injection-style flaw are not disclosed in the Microsoft Security Update CVE-2024-26204 advisory beyond the affected component and impact summary.

Detection Methods for CVE-2024-26204

Indicators of Compromise

• Outlook for Android clients running versions earlier than the patched release listed in the Microsoft advisory.
• Unexpected outbound network connections from the Outlook for Android process to non-Microsoft destinations.
• Anomalous mailbox access patterns or message-rendering errors logged on the Microsoft 365 backend.

Detection Strategies

• Inventory mobile devices and confirm the installed Outlook for Android build against the fixed version distributed via Google Play.
• Correlate Microsoft 365 audit logs (MailItemsAccessed, MessageRead) with mobile device identifiers to detect access from unpatched clients.
• Use mobile device management (MDM) compliance policies to flag devices running vulnerable Outlook versions.

Monitoring Recommendations

• Stream Microsoft 365 Unified Audit Logs and Intune device compliance events into a centralized SIEM for correlation.
• Alert on mailbox access events originating from Outlook for Android user agents reporting outdated app versions.
• Track Google Play managed app update status across the fleet to confirm rollout of the fixed release.

How to Mitigate CVE-2024-26204

Immediate Actions Required

• Update Outlook for Android to the patched build identified in the Microsoft Security Update CVE-2024-26204 advisory.
• Enforce automatic app updates through Google Play and Intune managed Google Play for enrolled devices.
• Block or quarantine mobile devices that remain on vulnerable Outlook versions using conditional access policies.

Patch Information

Microsoft addressed CVE-2024-26204 in an updated Outlook for Android release distributed through Google Play. Administrators should consult the Microsoft Security Update CVE-2024-26204 page for the exact fixed version and configure managed Google Play to push the update to enrolled devices.

Workarounds

• Apply Microsoft 365 conditional access rules that require a minimum Outlook for Android app version before granting mailbox access.
• Restrict Outlook for Android usage to MDM-enrolled devices where app version compliance can be enforced.
• Where patching is delayed, instruct users to access mail through Outlook on the web until the Android client is updated.

# Example: Intune app protection policy enforcing minimum Outlook for Android version
# (replace <fixed-version> with the build listed in the Microsoft advisory)
az intune app-protection-policy update \
  --policy-name "Outlook-Android-MinVersion" \
  --platform android \
  --min-app-version "<fixed-version>" \
  --action blockAccess