S(kim) will disable the preview feature for email attachments in Outlook (desktop application) starting Monday, May 4, for all centrally managed devices. This is in response to an attempted attack that we were able to successfully thwart.
What is the Outlook preview?
With a simple mouse click, the preview displays email attachments directly in the reading pane without requiring them to be opened separately. This allows users to quickly scan content without actively opening the file. While convenient, this feature carries certain risks.
Currently, there are no reliable statistics on how many malware programs can trigger an infection solely through the Outlook preview. There are known critical security vulnerabilities in certain Outlook versions where simply viewing an email could lead to the execution of malicious code. While such cases are usually quickly patched with security updates, they continue to occur.
We encountered such a case in December 2025: In the received email, simply previewing a specially crafted attachment was enough to trigger an infection attempt. However, since all affected systems were up to date and the endpoint security detected the malware in time, it remained an attempt, and further damage was prevented.
A tip: If your endpoints are not centrally managed, we recommend implementing such a system. After all, a single compromised IT system can jeopardize the security of the entire TH OWL.
Here’s how to specify which file types are previewed in Outlook:
- Open Outlook and click File.
- Select Options.
- Go to the Trust Center section.
- Click Trust Center Settings.
- Open the Attachment Handling section.
- Under Attachment and Document Preview, you can select which file types are allowed to be previewed.
We recommend disabling this for all document types from the Microsoft Office environment.
Good to know: You can still view attachments directly even after May 4: double-clicking directly in the email view will still open the file. However, this requires a deliberate action.
Contact
Phone: +49 5261 702 2222
Email: support(at)th-owl.de