[ 0day (xc) Our ] Microsoft Outlook 0day 2025 code by skraito with skraitow , Release in the Wild … . have fun … . testing and patching … .

Titles: Microsoft Outlook Remote Code Execution Vulnerability – RCE

CVE-2025-47171

Description

This proof-of-concept (PoC) demonstrates the CVE-2025-47171 vulnerability simulation. It injects a crafted mail item into Outlook containing a malicious sync path that triggers an action during scanning.

IMPORTANT:
This PoC simulates the vulnerable Outlook path parsing and triggers a creation of a text file on the user’s Desktop when the malicious path is detected.

---

Usage

1. Ensure you have Outlook installed and configured on your Windows machine.
2. Run the PoC script with Python 3.x (requires pywin32 package):pip install pywin32 python CVE-2025-47171.py
3. The script will:
   • Inject a mail item with the malicious sync path.
   • Wait 10 seconds for Outlook to process the mail.
   • Scan Inbox and Drafts folders.
   • Upon detection, normalize the path and trigger a system restart (creation of a text file on the user's Desktop).

---

Warning

• This script will create a text file on the user’s Desktop after 5 seconds once the payload is triggered.
• Save all work before running.
• Test only in a controlled or virtualized environment.
• Do NOT run on production or important systems.

---

Files

• CVE-2025-47171.py – The Python proof-of-concept script.
• README.md – This file.

---

License

This PoC is provided for educational and research purposes only. Use responsibly and ethically.

For Vulnerability databases providers!

• Kind Regards.

Download ZIP:

Video:

href

Source:

href

Time spent:

01:35:00