Blog

Security Research

Mute the Sound: Chaining Vulnerabilities to Achieve RCE on Outlook: Pt 1

Ben Barnea is a Security Researcher at Akamai with interest and experience in conducting low-level security research and vulnerability research across various architectures, including Windows, Linux, IoT, and mobile. He enjoys learning how complex mechanisms work and, more important, how they fail.

Executive summary

\r\n \r\n Akamai researcher Ben Barnea found two vulnerabilities in Microsoft Windows, which were assigned CVE-2023-35384 and CVE-2023-36710 .

\r\n

\r\n An attacker on the internet can chain the vulnerabilities together to create a full, zero-click remote code execution (RCE) exploit against Outlook clients.

\r\n

\r\n The first vulnerability lies in the parsing of a path by the MapUrlToZone function.…