What’s Vulnerable › Vulnerabilities

CVE-2019-1105: Outlook for Android Spoofing Vulnerability

• Severity: medium (CVSS 5.4 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-07-29 · updated 2026-06-17
• Weakness: CWE-79

Description

A spoofing vulnerability exists in the way Microsoft Outlook for Android software parses specifically crafted email messages. An authenticated attacker could exploit the vulnerability by sending a specially crafted email message to a victim. The attacker who successfully exploited this vulnerability could then perform cross-site scripting attacks on the affected systems and run scripts in the security context of the current user. The security update addresses the vulnerability by correcting how Outlook for Android parses specially crafted email messages.

Affected products

• Microsoft Outlook: all versions
• Microsoft Outlook: from 1.0 before Publication — fixed in Publication

How to fix

Upgrade to a fixed version: Microsoft Outlook Publication. Check the vendor advisory for mitigations.

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-1105
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1105

Get alerted when CVE-2019-1105 or the next vulnerability affects your stack