CVE-2023-33151

Deeper analysis

Microsoft Outlook contains a spoofing vulnerability that affects the way the application processes certain messages or content received over the network. The flaw is tracked as CVE-2023-33151 and carries a CVSS 3.1 score of 6.5, reflecting network attack vector, low attack complexity, no required privileges, and required user interaction that results in high confidentiality impact.

An unauthenticated remote attacker can exploit the issue by delivering crafted content that a user opens or previews in Outlook. Successful exploitation allows the attacker to spoof the origin or context of the message, potentially leading to disclosure of sensitive information from the victim's mailbox or client without altering data or disrupting availability.

Microsoft has published remediation guidance in its Security Response Center update guide for this vulnerability. The associated EPSS score remained low after disclosure but rose materially to a peak of 0.0741 on 2025-01-22 before receding to the current value of 0.0061, indicating a period of increased exploitation interest well after the initial publication date.