CVE-2001-1088: Microsoft Outlook

High severity, CVSS 7.5. EPSS: 19.7% chance of exploitation in the next 30 days.

Microsoft Outlook 8.5 and earlier, and Outlook Express 5 and earlier, with the "Automatically put people I reply to in my address book" option enabled, do not notify the user when the "Reply-To" address is different than the "From" address, which could allow an untrusted remote attacker to spoof legitimate addresses and intercept email from the client that is intended for another user.

Affected products

• Microsoft Outlook: version 97 only; version 98 only; version 2000 only
• Microsoft Outlook Express: version 4.0 only; version 4.5 only; version 4.27.3110 only; version 4.72.2106 only; version 4.72.3120.0 only; version 4.72.3612 only; …

Published 2001-06-05. Last modified 2026-06-16.