Zerodium offers $400,000 for Microsoft Outlook RCE zero-day exploits

Zero-day exploit broker Zerodium announced it will pay $400,000 for zero-day RCE in Microsoft Outlook email client.

The zero-day exploit broker Zerodium has announced it will pay $400,000 for zero-day remote code execution (RCE) vulnerabilities in the Microsoft Outlook email client.

The company pointed out that the increased payout for this specific vulnerability exploit is temporary, but it did not disclose the deadline for submissions.

“We are temporarily increasing our payout for Microsoft Outlook RCEs from $250,000 to $400,000. We are looking for zero-click exploits leading to remote code execution when receiving/downloading emails in Outlook, without requiring any user interaction such as reading the malicious email message or opening an attachment. Exploits relying on opening/reading an email may be acquired for a lower reward.” reads the announcement of temporary bounty.

The bounty for zero-click RCE exploits for a vulnerability in Microsoft Outlook for Windows jumped from $250,000 to $400,000.

A zero-click exploit is a code that could trigger the vulnerability without any user interaction. In the case of Microsoft Outlook for Windows it is enough to send a message to the email client to trigger the issue.

Zerodium is also temporarily offering $250,000 for RCE exploits in Mozilla Thunderbird, instead of $200,000.

“We are looking for zero-click exploits affecting Thunderbird and leading to remote code execution when receiving/downloading emails, without requiring any user interaction such as reading the malicious email message or opening an attachment. Exploits relying on opening/reading an email may be acquired for a lower reward.” continues the company.

The last announcement for temporary bounties is dated March 31, 2021, when Zerodium announced that it was temporarily tripling the bounty for WordPress RCE exploits. The payouts for WordPress RCEs passed from $100,000 to $300,000, and the offer is still active.

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, REvil ransomware)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.