PoC Released for Outlook “MonikerLink” RCE Flaw Allowing Remote Code Execution

Security researchers have released a proof-of-concept (PoC) exploit for CVE-2024-21413, a critical remote code execution vulnerability in Microsoft Outlook dubbed “MonikerLink.”

This flaw enables attackers to execute arbitrary code on victim systems via specially crafted emails, posing a serious risk to organizations worldwide.​

Field	Details
CVE ID	CVE-2024-21413
Vulnerability Name	MonikerLink Bug
CVSS Score	9.8
Severity	Critical
CWE ID	CWE-20 (Improper Input Validation)
Vulnerability Type	Remote Code Execution (RCE)

Vulnerability Overview

The MonikerLink vulnerability affects how Microsoft Outlook processes certain hyperlinks within emails.

Discovered by Check Point Research, the flaw allows attackers to bypass Outlook’s security restrictions by adding a special exclamation mark (“!”) character to file paths in email hyperlinks.

When users click on malicious links formatted as file:///\\IP\test\test.rtf!something, Outlook treats them as “Moniker Links” and processes them through Windows COM APIs, bypassing regular security warnings.

The vulnerability presents multiple attack opportunities for threat actors. Successful exploitation can result in the leakage of local NTLM credentials, which attackers can use to compromise the network further.

More concerning is the ability to achieve complete remote code execution without triggering Protected View. This safety feature opens potentially dangerous files in a restricted mode.

The PoC exploit, available on GitHub, demonstrates how attackers can craft malicious emails that steal NTLM hashes with zero-click exploitation in the Outlook preview pane.

The exploit uses SMTP authentication to send emails that bypass SPF, DKIM, and DMARC security checks, simulating real-world attack conditions.

Active Exploitation Confirmed

CISA added CVE-2024-21413 to its Known Exploited Vulnerabilities Catalog in February 2025, confirming active exploitation in the wild.

The agency has mandated that federal agencies apply patches by the designated deadline and recommends that all organizations prioritize remediation immediately.

Organizations can detect exploitation attempts using multiple methods. Security researcher Florian Roth has developed YARA rules that identify emails containing the malicious file:\\ element pattern.

Network monitoring with Wireshark can also capture suspicious SMB traffic indicative of NTLM credential theft attempts.​

Microsoft released security updates during the February 2024 Patch Tuesday to address this vulnerability.

Organizations should immediately apply these patches across all affected Microsoft Office installations.

For environments where patching is delayed, turning off outbound SMB traffic to external addresses provides temporary mitigation.

Check Point researchers warn that the MonikerLink vulnerability extends beyond Outlook. The underlying issue stems from the unsafe use of Windows COM APIs, specifically MkParseDisplayName() and MkParseDisplayNameEx(), which could make other applications similarly vulnerable.

This positions the bug as a systemic Windows ecosystem issue comparable to the Log4j vulnerability that affected Java environments.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.