CVE-2000-0524: Microsoft Outlook and Outlook Express allow remote attackers to cause a denial of service by sending email...

Security readout for executives and security teams

A very old flaw in Microsoft Outlook and Outlook Express let someone crash the email client by sending a message with certain empty header fields, such as BCC, Reply-To, Return-Path, or From. It is a denial-of-service issue against the mail client itself, not a data theft or takeover bug. The affected software versions are from around the year 2000 and have long been superseded by newer Outlook releases. Exposure is effectively negligible in modern environments. The vulnerability targets Outlook and Outlook Express versions from the year 2000; those builds are unsupported and have been replaced across nearly all managed estates. Only organizations still running legacy Windows workstations with the original Outlook Express client would face residual risk. Informational only. This is a 25-year-old crash bug in an obsolete email client with no KEV listing and no signs of active exploitation. It does not warrant emergency action, budget, or executive attention unless legacy Outlook Express remains deployed anywhere in the environment. Mitigation focus: Confirm no Outlook Express or year-2000-era Outlook builds remain in production or lab environments.; Ensure all mail clients are on a currently supported Microsoft 365 or Outlook release with active updates.; Consult Microsoft vendor guidance if any legacy Outlook Express instance must remain operational..

Prepared

Jul 12, 2026, 01:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.