Microsoft Windows Mail vulnerabilities

6 CVEs affecting Microsoft Windows Mail, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-8305, published 2018-07-11.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2007-3897, published 2007-10-09. High severity, CVSS 9.3. EPSS: 54.6% chance of exploitation in the next 30 days. Heap-based buffer overflow in Microsoft Outlook Express 6 and earlier, and Windows Mail for Vista, allows remote Network News Transfer Protocol (NNTP) servers to execute arbitrary code via long NNTP…
• CVE-2008-1448, published 2008-08-13. High severity, CVSS 7.1. EPSS: 26.6% chance of exploitation in the next 30 days. The MHTML protocol handler in a component of Microsoft Outlook Express 5.5 SP2 and 6 through SP1, and Windows Mail, does not assign the correct Internet Explorer Security Zone to UNC share pathnames,…
• CVE-2007-2227, published 2007-06-12. Medium severity, CVSS 4.3. EPSS: 25% chance of exploitation in the next 30 days. The MHTML protocol handler in Microsoft Outlook Express 6 and Windows Mail in Windows Vista does not properly handle Content-Disposition "notifications," which allows remote attackers to obtain…
• CVE-2007-2225, published 2007-06-12. Medium severity, CVSS 4.3. EPSS: 25% chance of exploitation in the next 30 days. A component in Microsoft Outlook Express 6 and Windows Mail in Windows Vista does not properly handle certain HTTP headers when processing MHTML protocol URLs, which allows remote attackers to obtain…
• CVE-2010-0816, published 2010-05-12. High severity, CVSS 9.3. EPSS: 20.3% chance of exploitation in the next 30 days. Integer overflow in inetcomm.dll in Microsoft Outlook Express 5.5 SP2, 6, and 6 SP1; Windows Live Mail on Windows XP SP2 and SP3, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and…
• CVE-2018-8305, published 2018-07-11. Medium severity, CVSS 6.5. EPSS: 8.6% chance of exploitation in the next 30 days. An information disclosure vulnerability exists in Windows Mail Client when a message is opened, aka "Windows Mail Client Information Disclosure Vulnerability." This affects Mail, Calendar, and People…