CVE-2004-2137: Outlook Express 6.0, when sending multipart e-mail messages using the "Break apart messages larger than" se...

Security readout for executives and security teams

Outlook Express 6.0 can expose hidden BCC recipients when sending split multipart messages using the "Break apart messages larger than" setting. The business impact is privacy and confidentiality loss: people in To or CC may see recipients who were meant to remain undisclosed. Exposure appears limited to environments still using Outlook Express 6.0 and the affected message-splitting setting. Organizations without that client or workflow are unlikely to be exposed based on the provided evidence. Prioritize as a confidentiality and privacy issue, not a broad compromise risk. Urgency is highest where sensitive mailing lists, whistleblower contacts, clients, or regulated personal data could be disclosed. Mitigation focus: Review Microsoft KB 843555 and vendor guidance for available remediation.; Disable or avoid the affected message-splitting setting where Outlook Express 6.0 remains in use.; Use an unaffected supported email client for sensitive recipient lists..

Prepared

Jun 29, 2026, 20:09 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.