#denial-of-service
1post tagged with "denial-of-service"
crashing outlook with a nested s/mime email: cwe-674 in the shared windows mime engine
•13 min read•Security
a remote, largely zero-click denial of service in outlook and the windows search indexer: an opaque-signed pkcs#7 message nested a few thousand layers deep exhausts the thread stack because the shared mime decoder has no recursion depth limit. found statically with glaurung, declined by microsoft as low severity, disclosed here so mail scanners can detect it and vendors can add the one-line cap.