Cyber Resilience

CVE-2023-35311

Race Condition in Microsoft Outlook 2013 … 2016

CISA KEVActive ExploitationEUVD ExploitedRace Condition
Published
11 July 2023
Modified
28 October 2025
KEV Added
11 July 2023
Patch / advisory
CVSS Score v3.1 8.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.16 96th percentile
Risk Priority 87 floored blend · peak EPSS

Summary

CVE-2023-35311 is a high-severity Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367) vulnerability in Microsoft Outlook. Its CVSS base score is 8.8 (High).

Operationally, ranked in the top 4% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.

The strongest mitigations our analysis identified map to SI-2 (Flaw Remediation) and SI-3 (Malicious Code Protection) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

Microsoft Outlook contains a security feature bypass vulnerability tracked as CVE-2023-35311. The flaw, assigned CWE-367, resides in the client’s handling of messages or attachments and received a CVSS 3.1 score of 8.8 reflecting network attack vector, low complexity, no required privileges, and high impact on confidentiality, integrity, and availability.

An unauthenticated remote attacker can exploit the issue by sending a specially crafted message that triggers a race condition, allowing the security feature to be bypassed when the recipient interacts with the content. Successful exploitation can result in disclosure of sensitive information, modification of data, or full compromise of the Outlook process and underlying system.

Microsoft’s advisory directs customers to apply the security update released in July 2023; the vulnerability is also listed in CISA’s Known Exploited Vulnerabilities catalog, confirming that in-the-wild exploitation has been observed.

EPSS for the CVE rose sharply from a low baseline to a peak of 0.7572 on 28 October 2024 before receding, indicating that meaningful exploitation interest developed well after initial disclosure.

EU & UK References

Vulnerability Data

Microsoft Outlook Security Feature Bypass Vulnerability

CWE(s)
KEV Date Added
11 July 2023

Related Threats

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1566.001 Spearphishing Attachment Initial Accessconfidence: HIGH
Specially crafted message/attachment sent to trigger the race condition bypass matches spearphishing attachment delivery.
T1204.002 Malicious File Executionconfidence: HIGH
User interaction with the malicious message or attachment is required to trigger the vulnerability.
T1189 Drive-by Compromise Initial Accessconfidence: MEDIUM
Drive-by compromise via malicious email content is plausible given the Outlook client-side attack vector.
inferred from description + CWE · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2023-23397Same product: Microsoft 365 Appsboth on KEV
CVE-2023-36761Same product: Microsoft 365 Appsboth on KEV
CVE-2021-42292Same product: Microsoft 365 Appsboth on KEV
CVE-2024-38020Same product: Microsoft 365 Apps
CVE-2021-38646Same product: Microsoft 365 Appsboth on KEV
CVE-2023-36763Same product: Microsoft 365 Apps
CVE-2023-36893Same product: Microsoft 365 Apps
CVE-2024-30088Same vendor: Microsoftboth on KEV
CVE-2024-38173Same product: Microsoft 365 Apps
CVE-2024-21378Same product: Microsoft 365 Apps

Affected Assets

microsoft
365 apps
all versions
microsoft
office
2019
microsoft
office long term servicing channel
2021
microsoft
outlook
2013, 2016

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-2 Flaw Remediation
  • SI-3 Malicious Code Protection
Detect
Catch it (NIST detect / respond)
  • SI-3 Malicious Code Protection
  • SI-7 Software, Firmware, and Information Integrity
Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V15.4.2
  • V17.2.6

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires applying the July 2023 security update that eliminates the race condition (CWE-367) in Outlook's message/attachment handling.

preventdetect

Enforces malicious-code inspection and sandboxing of incoming messages and attachments that the bypassed security feature was intended to block.

detect

Verifies integrity of the Outlook executable and libraries, enabling detection of post-exploitation tampering that follows successful bypass.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly include coding standards and reviews that prevent TOCTOU race conditions.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

none

Reliable, synchronized time across systems narrows the exploitable window in which a resource state can change between a security check and its use.

References