CVE-2019-1084: Microsoft Exchange Server

Medium severity, CVSS 6.5. EPSS: 5.3% chance of exploitation in the next 30 days.

An information disclosure vulnerability exists when Exchange allows creation of entities with Display Names having non-printable characters. An authenticated attacker could exploit this vulnerability by creating entities with invalid display names, which, when added to conversations, remain invisible. This security update addresses the issue by validating display names upon creation in Microsoft Exchange, and by rendering invalid display names correctly in Microsoft Outlook clients., aka 'Microsoft Exchange Information Disclosure Vulnerability'.

Affected products

• Microsoft Exchange Server: version 2010 only; version 2013 only; version 2016 only
• Microsoft Lync: version 2013 only
• Microsoft Lync Basic: version 2013 only
• Microsoft Mail And Calendar: affected versions not specified
• Microsoft Office: version 2010 only; version 2013 only; version 2016 only; version 2019 only
• Microsoft Office 365 Proplus: affected versions not specified
• Microsoft Outlook: affected versions not specified; version 2013 only; version 2016 only
• Microsoft Skype For Business: version 2016 only
• Microsoft Skype For Business Basic: version 2016 only

Published 2019-07-15. Last modified 2026-06-17.