@fonetone hey! I believe the cve affects both rtf emails and regular documents as well. In my proof-of-concept I provided a RTF document for simplicity sakes, as reproducing the vulnerability via e-mail would require a more complicated setup. Nevertheless, any application that parses RTF files is most likely vulnerable, as they will all use the vulnerable ole32. dll library to extract OLE object data from RTF data.

on a separate note, it is indeed confusing that Microsoft makes an effort to single-out outlook/email use-case, I imagine it is so because it's the only application they ship where the vuln could be triggered without user interaction.

@jaydinbas thanks! and sorry for a late reply. in theory it should be possible to trigger the vulnerability via OLE2.0 objects. I haven't yet published the details on how the proof of concept works, but I will hopefully do it soon.

In short - as long as the application calls OleLoad (or a variant) on the object, and the object has a CLSID corresponding to StaticDib or StaticMetafile with the clipboard format in data being set to 2 (CF_BITMAP), you should be able to trigger the vuln.