CVE-2023-35311: Microsoft Outlook security feature bypass via TOCTOU race condition

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityThe flaw is in the CISA KEV catalog with known exploitation, has a high CVSS score of 8.8, and affects widely deployed Microsoft Outlook and Office products.

What it is

CVE-2023-35311 is a security feature bypass in Microsoft Outlook caused by a time-of-check time-of-use (TOCTOU) race condition (CWE-367). It affects Microsoft 365 Apps, Office, Office Long Term Servicing Channel, and Outlook. Because it bypasses a security feature, it can undermine protections that users and administrators rely on to block malicious content.

Impact

An attacker can bypass an Outlook security feature, which may allow malicious content or actions that the feature was meant to prevent. The CVSS vector indicates high confidentiality, integrity, and availability impact, though the record does not specify the exact protected mechanism.

Attack surface

The vulnerability is network-reachable (AV:N) with low attack complexity (AC:L) and no privileges required (PR:N), but it requires user interaction (UI:R). This is consistent with a crafted email or Outlook item that the user must open or interact with.

Exploitation

CISA added CVE-2023-35311 to the Known Exploited Vulnerabilities catalog on 2023-07-11, indicating exploitation in the wild. EPSS gives a 30-day exploitation probability of 0.15522 (96.6th percentile), and the record does not document ransomware campaign use.

What to do

• Apply the Microsoft security updates referenced in the MSRC advisory for Outlook and affected Office products.
• If patching is not immediately possible, follow CISA guidance to discontinue use of the affected product or apply compensating controls.
• Prioritize patching for internet-facing and email-handling systems, especially where Outlook is used to open untrusted messages.
• Review and tighten email filtering and attachment handling to reduce delivery of crafted messages that could trigger the bypass.
• Monitor vendor advisories for updated guidance and any revised affected product lists.

Detection

• Hunt for Outlook process behavior that deviates from normal after opening email or attachments, such as unexpected child processes or file writes.
• Correlate endpoint telemetry for TOCTOU-style race patterns in Outlook, including rapid file or registry access sequences around message rendering.
• Monitor for exploitation indicators published by Microsoft and CISA, and alert on known malicious message characteristics if available.
• Audit patch levels for Outlook and Office products against the MSRC advisory to identify unpatched endpoints.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.