CVE-2023-29325 is a critical vulnerability that could allow attackers to execute malicious code on your computer through an exploit in Outlook. Microsoft has released a security update to fix this flaw as part of its May 2023 Patch Tuesday.

What is CVE-2023-29325 and how does it work?

CVE-2023-29325 is a remote code execution (RCE) vulnerability that exists in the way Outlook handles specially crafted email messages. According to Microsoft, an attacker could exploit this vulnerability by sending a malicious email to a victim and convincing them to open or preview it in Outlook. The email could contain an embedded image or attachment that triggers the vulnerability and allows the attacker to run arbitrary code on the victim’s system.

The code would run in the context of the current user, which means that if the user has administrative privileges, the attacker could take complete control of the system. The attacker could then install malware, steal data, create new accounts, or perform other malicious actions.

How to detect and prevent exploitation?

To check if you are vulnerable to CVE-2023-29325, you need to verify the version of Outlook that you are running and compare it with the affected versions listed in Microsoft’s advisory. You can find your Outlook version by following these steps:

1. Open Outlook and click on File.
2. Click on Office Account or Account.
3. Click on About Outlook.
4. Look for the version number and build number in the dialog box that appears and make sure the build number is 16.0.13901.20462 or later for Outlook 2019 and 16.0.13901.20466 or later for Outlook 2020

To apply the security update for CVE-2023-29325, you have three options:

1. Use Windows Update to automatically download and install the latest updates for your system. To do this, follow these steps:
   • Click on Start and type Windows Update.
   • Click on Check for updates and wait for Windows to scan for available updates.
   • If you see any updates related to Outlook or Microsoft Office, select them and click on Install now.
   • Restart your computer if prompted.
2. Download and install the Update via Office, to do this, follow these steps:
   • Open Outlook and click File in the top left
   • Click on Account
   • Click on Update Options and select Update Now (All Office applications will need to close / restart for this to complete)
3. Download and install the update manually from Microsoft’s Update Catalog. To do this, follow these steps:
   • Go to Microsoft’s Update Catalog website and search for your Outlook version and build number.
   • Find the update that matches your system architecture (32-bit or 64-bit) and click on Download.
   • Run the downloaded file and follow the instructions to install the update.
   • Restart your computer if prompted.

As usual you should update update your system(s) as soon as possible to avoid exploitation