[ 0day (xc) Our ] Microsoft Outlook 0day 2025 code by skraito with skraitow , Release in the Wild … . have fun … . testing and patching … .
Titles: Microsoft Outlook Remote Code Execution Vulnerability – RCE
CVE-2025-47171
Description
This proof-of-concept (PoC) demonstrates the CVE-2025-47171 vulnerability simulation. It injects a crafted mail item into Outlook containing a malicious sync path that triggers an action during scanning.
IMPORTANT:
This PoC simulates the vulnerable Outlook path parsing and triggers a creation of a text file on the user’s Desktop when the malicious path is detected.
Usage
- Ensure you have Outlook installed and configured on your Windows machine.
- Run the PoC script with Python 3.x (requires
pywin32package):pip install pywin32 python CVE-2025-47171.py - The script will:
- Inject a mail item with the malicious sync path.
- Wait 10 seconds for Outlook to process the mail.
- Scan Inbox and Drafts folders.
- Upon detection, normalize the path and trigger a system restart (
creation of a text file on the user's Desktop).
Warning
- This script will create a text file on the user’s Desktop after 5 seconds once the payload is triggered.
- Save all work before running.
- Test only in a controlled or virtualized environment.
- Do NOT run on production or important systems.
Files
CVE-2025-47171.py– The Python proof-of-concept script.README.md– This file.
License
This PoC is provided for educational and research purposes only. Use responsibly and ethically.
For Vulnerability databases providers!
- Kind Regards.
Video:
Source:
Time spent:
01:35:00
Leave a Reply