CVE-2022-35742
📋 TL;DR
CVE-2022-35742 is a denial-of-service vulnerability in Microsoft Outlook that allows attackers to crash the application by sending specially crafted emails. This affects users running vulnerable versions of Microsoft Outlook on Windows systems. The vulnerability requires user interaction to open or preview malicious emails.
💻 Affected Systems
- Microsoft Outlook
📦 What is this software?
365 Apps by Microsoft
Office by Microsoft
Office Long Term Servicing Channel by Microsoft
View all CVEs affecting Office Long Term Servicing Channel →
Outlook by Microsoft
Outlook by Microsoft
Outlook by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
Complete Outlook application crash requiring restart, potential loss of unsaved work, and disruption to email communication workflows.
Likely Case
Temporary Outlook application crash affecting individual users who open malicious emails, requiring application restart.
If Mitigated
Minimal impact with proper email filtering and user awareness training preventing malicious emails from reaching users.
🎯 Exploit Status
Exploitation requires user interaction to open malicious email. No authentication bypass needed beyond standard email delivery.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: August 2022 security updates for Microsoft Office/Outlook
Vendor Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35742
Restart Required: Yes
Instructions:
1. Open Microsoft Outlook. 2. Go to File > Office Account > Update Options > Update Now. 3. Alternatively, use Windows Update to install the latest Office security updates. 4. Restart Outlook after update installation.
🔧 Temporary Workarounds
Disable email preview pane
windowsPrevents automatic triggering when viewing email list by disabling preview functionality
In Outlook: View > Message Preview > Off
Use Outlook Web Access
allSwitch to web-based Outlook which is not affected by this vulnerability
🧯 If You Can't Patch
- Implement email filtering to block suspicious emails with unusual attachments or content
- Provide user awareness training about not opening emails from unknown senders
🔍 How to Verify
Check if Vulnerable:
Check Outlook version: File > Office Account > About Outlook. If version is prior to August 2022 updates, system is vulnerable.Check Version:
In Outlook: File > Office Account > About OutlookVerify Fix Applied:
Verify Outlook version shows August 2022 or later updates installed and attempt to reproduce with test email (not recommended in production).📡 Detection & Monitoring
Log Indicators:
- Outlook application crash logs in Windows Event Viewer
- Multiple Outlook restarts from same user in short timeframe
Network Indicators:
- Incoming emails with unusual MIME types or large nested attachments
SIEM Query:
EventID=1000 AND Source='Outlook' AND 'faulting module' contains relevant DLL names