Outlook Express vulnerabilitiesRanked by how likely they are to be used.
Outlook Express is made by Microsoft. We track 45 published vulnerabilities listed under that exact name, across 22 versions. None of them is on the list of flaws known to be exploited today. Microsoft lists newer releases under their own names, such as Outlook Express Book Control, so check those pages too.
We keep watching the known-exploited list.
Is Outlook Express listed under other names? Yes.
Microsoft also lists Outlook Express under more specific names, such as Outlook Express Book Control. Flaws listed only under those names are counted on their own pages, not here. If you run one of these, open its page for its own exploited flaws.
Which Outlook Express vulnerabilities are being exploited?
This is the list that matters most: flaws criminals are using now.
None of Outlook Express's published vulnerabilities is on the list of flaws known to be exploited today. We keep watching that list.
Which Outlook Express flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 74%CVE-2005-1213High
Stack-based buffer overflow in the news reader for Microsoft Outlook Express (MSOE.DLL) 5.5 SP2, 6, and 6 SP1 allows remote malicious NNTP servers to execute arbitrary code via a LIST response with a long second field.
- 63%CVE-2004-0380Critical
The MHTML protocol handler in Microsoft Outlook Express 5.5 SP2 through Outlook Express 6 SP1 allows remote attackers to bypass domain restrictions and execute arbitrary code, as demonstrated on Internet Explorer...
- 55%CVE-2007-3897Critical
Heap-based buffer overflow in Microsoft Outlook Express 6 and earlier, and Windows Mail for Vista, allows remote Network News Transfer Protocol (NNTP) servers to execute arbitrary code via long NNTP responses that...
- 40%CVE-2006-2111Medium
A component in Microsoft Outlook Express 6 allows remote attackers to bypass domain restrictions and obtain sensitive information via redirections with the mhtml: URI handler, as originally reported for Internet...
- 32%CVE-2000-0567Medium
Buffer overflow in Microsoft Outlook and Outlook Express allows remote attackers to execute arbitrary commands via a long Date field in an email header, aka the "Malformed E-mail Header" vulnerability.
- 29%CVE-2006-2386Medium
Unspecified vulnerability in Microsoft Outlook Express 6 and earlier allows remote attackers to execute arbitrary code via a crafted contact record in a Windows Address Book (WAB) file.
- 27%CVE-2001-1325High
Internet Explorer 5.0 and 5.5, and Outlook Express 5.0 and 5.5, allow remote attackers to execute scripts when Active Scripting is disabled by including the scripts in XML stylesheets (XSL) that are referenced using...
- 27%CVE-2000-0653Medium
Microsoft Outlook Express allows remote attackers to monitor a user's email by creating a persistent browser link to the Outlook Express windows, aka the "Persistent Mail-Browser Link" vulnerability.
- 27%CVE-2008-1448High
The MHTML protocol handler in a component of Microsoft Outlook Express 5.5 SP2 and 6 through SP1, and Windows Mail, does not assign the correct Internet Explorer Security Zone to UNC share pathnames, which allows...
- 26%CVE-2004-2137Medium
Outlook Express 6.0, when sending multipart e-mail messages using the "Break apart messages larger than" setting, leaks the BCC recipients of the message to the addresses listed in the To and CC fields, which may...
Running Outlook Express? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 new flaw affects software Acme tracks
Stack-based buffer overflow in the news reader for Microsoft Outlook Express (MSOE.DLL) 5.5 SP2, 6, and 6 SP1 allows remote malicious NNTP servers to execute arbitrary code via a LIST response with a long second field.
- Matched to
- Outlook Express on Acme's software list
- What to do
- Plan in the vendor’s update
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
We track 45 published vulnerabilities listed under the name Outlook Express, across 22 versions.
None of Outlook Express's vulnerabilities is on the list of flaws known to be exploited today.
Microsoft also lists Outlook Express under more specific names, such as Outlook Express Book Control. Flaws listed only under those names are counted on their own pages, not here. Open the release you run to see its own list.
Create a Precursor Intelligence account and track Outlook Express. We match it against every published flaw, give each one a risk score from 0 to 100 and keep watching, so you hear about new ones as soon as we know, by email, in the app or by webhook.