CVE-2004-0121: Microsoft Office

High severity, CVSS 7.5. EPSS: 47.7% chance of exploitation in the next 30 days.

Argument injection vulnerability in Microsoft Outlook 2002 does not sufficiently filter parameters of mailto: URLs when using them as arguments when calling OUTLOOK.EXE, which allows remote attackers to use script code in the Local Machine zone and execute arbitrary programs.

Affected products

• Microsoft Office: version xp only
• Microsoft Outlook: version 2002 only

Published 2004-04-15. Last modified 2026-06-16.