Microsoft Outlook Information Disclosure Vulnerability

CVE-2023-35636 is an information disclosure vulnerability in Microsoft Office Outlook (rated Important, CVSS 6.5).

1 version

Microsoft id: CVE-2023-35636
Products: Microsoft Office Outlook
Severity: Important
Impact: Information Disclosure
CVSS: 6.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
Exploited: No
Publicly disclosed: No
Exploitability: Exploitation Less Likely
Customer action required: Yes
Release: 2023-Dec
Assigned by: Microsoft
Weakness: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
MSRC revision: 1.0
Status pages: Outlook status
First captured by us: 13 Nov 2026, 14:54 UTC (from our first import of this list)
Microsoft last modified: 12 Dec 2023, 08:00 UTC
Source: Security updates · open the original at Microsoft

Microsoft's revision notes

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?

Security updates, 08:00 UTC, 12 Dec 2023

One version so far. If Microsoft edits it, each change shows here with what was removed and added.

First version we captured · 14:54 UTC, 13 Nov
The text as we first saw it
Seen by us 14:54 UTC, 13 Nov · Microsoft's timestamp 08:00 UTC, 12 Dec 2023 · Microsoft's page