ZERO-CLICK OLE RCE IMPACTS MICROSOFT OUTLOOK

Summary from the TLDR InfoSec newsletter

Microsoft has patched a critical vulnerability in Windows Object Linking and Embedding (OLE) caused by a double-free in ole32.dll. An attacker can exploit this vulnerability to execute arbitrary code by sending a malicious RTF file, which is previewed by a victim in Microsoft Outlook. This post includes PoC code and threat hunting queries for the vulnerability.