Microsoft Outlook December updates trigger ICS security alerts

Microsoft confirmed that December 2023 Office security updates intended to remediate CVE-2023-35636 (an Outlook information disclosure vulnerability) are causing unexpected security warning dialogs when users open locally saved .ICS calendar files; the company calls the behavior a bug, has published a temporary registry workaround (which disables hyperlink/security prompts more broadly), and plans a future fix. The underlying CVE could allow attackers to trick users into opening crafted files to steal NTLM hashes for authentication and lateral movement if unpatched.