CVE-2023-23397: critical vulnerability in Microsoft 365 Apps for Enterprise

Microsoft Outlook contains a flaw that allows attackers to gain administrative privileges on a computer by sending specially crafted email messages. This is critical because an attacker can take full control of the system without requiring the user to click suspicious links or perform special actions.

An improper input validation vulnerability (CWE-20) in Microsoft Outlook allows remote code execution and privilege escalation through maliciously crafted email messages. The attack vector is network-based; an unauthenticated attacker can trigger the vulnerability by sending a specially formatted email that exploits inadequate validation of message content, resulting in arbitrary code execution with elevated privileges.