Images are blocked and meeting body is read only in Outlook Desktop if calendar items are from other senders for Microsoft Outlook Spoofing Vulnerability released August 8, 2023

Last Updated: November 30, 2023

ISSUE

When you receive meeting items sent from any other sender (internal or external), the security update makes two changes:

1. The meeting is now read only for the recipient. It is no longer possible to make changes to the body of the meeting or to attach files to the meeting.

2. Images in the meeting item that are stored on network paths such as UNC shares (\\server), file share paths (File://server), or external URL paths (https://) are blocked.

This issue happens after installing the Outlook Desktop August 8th, 2023, security updates. For additional information see the respective CVE below:

• CVE-2023-36893

• Release notes for Microsoft Office security updates

STATUS: RESOLUTION

Add the Edit Meeting button to the Quick Access Toolbar

1. In Outlook Desktop switch to your calendar and open a meeting item

2. Select File, Options, then Quick Access Toolbar.

3. Under Choose commands from: click the dropdown and select Commands Not in the Ribbon.

4. Select Edit Meeting, then click Add>> to add it to the Quick Access Toolbar.

5. Use the Move Up arrow to place it in the order you want.

6. Select OK to exit Customize the Quick Access Toolbar.
   

Add the Edit Meeting button to the Ribbon

1. In Outlook Desktop switch to your calendar and open a meeting item.

2. Select File, Options, then Customize Ribbon.

3. In the right column under Customize the classic ribbon, under Main Tabs, select Appointment.

4. Select New Group and then after it appears, rename it Edit Meeting. You can rename it later if you prefer.

5. Use the Move Up arrow to move the Edit Meeting button under Actions. Keep the new group Edit Meeting selected.

6. Using the column on the left, under Choose commands from: click the dropdown and select Commands Not in the Ribbon.

7. In the picker box, locate and select Edit Meeting, then click Add to add it to the custom group you just created.

8. Select OK to exit Customize the Ribbon.
   

Download an image to view it

If the image path is legitimate, you can still download the image to view it.

1. Right-click the image.

2. Select Download Pictures or Save as Picture as appropriate.
   

The meeting body is read only. If you need to keep notes on the meeting, consider these alternate solutions: 

• Take meeting notes in Microsoft Teams

• Take OneNote notes in a meeting

• Create or schedule an appointment

Normally adding the external sender to Safe Senders would enable the pictures to download automatically and the calendar item would be editable. For external received calendar items this will no longer apply and the resolution steps above are required.

Additional Resources

Add recipients of my email messages to the Safe Senders List

Block or unblock automatic picture downloads in email messages