Microsoft Outlook Spoofing Vulnerability

How could an attacker exploit this vulnerability?
An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook. Opening the file could cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning, potentially disclosing authentication information that could be used to impersonate the user. Exploitation requires network connectivity and user interaction.

Is the Preview Pane an attack vector for this vulnerability?
No, the Preview Pane is not an attack vector.

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
An attacker must send a user a malicious Office file and convince them to open it.

According to the CVSS metrics, successful exploitation of this vulnerability could lead to major loss of confidentiality (C:H). What does that mean for this vulnerability?
This vulnerability discloses a user's NTLMv2 hash to the attacker who could use this to authenticate as the user.

Security updates
16.0.14334.21048 — https://docs.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates
https — https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates