CVE-2003-1378: Microsoft Outlook Express 6.0 and Outlook 2000, with the security zone set to Internet Zone, allows remote...

Security readout for executives and security teams

This is an old Microsoft mail-client issue where a crafted HTML email could cause Outlook Express 6.0 or Outlook 2000 to run a program when mail is handled in the Internet Zone. The source bundle does not identify a current patch or active exploitation. Exposure is most likely in legacy environments still running Outlook Express 6.0 or Outlook 2000, especially where HTML email rendering and Internet Zone behavior remain enabled. Modern Microsoft mail clients are not named in the supplied affected evidence. Treat this as a legacy risk cleanup item with high impact if exposed. It should not displace urgent modern exploited vulnerabilities, but any confirmed affected client should be removed or isolated because supported defenses and vendor guidance may be limited. Mitigation focus: Identify and retire Outlook Express 6.0 and Outlook 2000 installations.; Check Microsoft archival guidance before assuming a specific patch or setting fixes this issue.; Restrict or disable HTML email rendering on any unavoidable legacy clients..

Prepared

Jun 29, 2026, 02:08 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.