CVE-2024-42191 is a medium severity (CVSS 6.5) vulnerability in HCL Traveler for Microsoft Outlook (HTMO). A COM hijacking weakness could let an attacker modify or replace the application with malicious content. The record gives no fixed version, so read HCL's knowledge base article KB0120745 and apply the update it names.
What's affected
The NVD record names HCL Traveler for Microsoft Outlook (HTMO) as the affected product. It does not list version numbers or fixed versions.
HCL publishes the details in knowledge base article KB0120745. When I fetched that page, it rendered only a loading message, so I could not read the affected and fixed versions. Open the article in a browser with your HCL support login if needed, and take the version list from there.
The vector is local and needs high privileges and user interaction, so the attacker needs a foothold on the workstation first.
How to check if you're exposed
Find out whether you run HCL Traveler for Microsoft Outlook (HTMO) at all. Ask the team that owns collaboration, analytics or cloud tools, because these products are often installed by a business unit.
Then read the version from the product's about or admin page, and compare it with the affected and fixed versions in article KB0120745.
If the article is hard to reach, open a case with HCL support and ask for the fixed version in writing.
What to do now
- Read HCL article KB0120745 and write down the affected and fixed versions.
- Update to the fixed version the article names.
- Restrict who can change files in the HTMO install folder and registry keys.
- Check the HTMO install for files you do not recognise, and compare them with a clean install.
- Remove local administrator rights from users who do not need them.
Why it matters
The class is CWE-427, uncontrolled search path element. COM is the Windows component model. Programs look up components in the registry, and a per-user entry can point the lookup at a different file. If an attacker can write that entry, the program may load their component instead of the real one.
Like the sibling DLL hijacking issue, this is local and needs a foothold. Defenders can watch for changes to the registry keys that map COM classes to files, restrict who can write them, and apply the vendor update. Endpoint tools often have detections for COM registration changes.
A note on vendor articles. Some support portals load their content with scripts, so a plain page fetch or a text-only reader shows nothing. If you track advisories with an automated tool, check that it can read the articles you depend on, or you may miss the fixed version. Keep a record of the article number, the date you read it and the version you chose, so the audit trail is clear if someone asks later.
Quick check
How is COM hijacking different from DLL hijacking?
DLL hijacking abuses the library search order. COM hijacking abuses registry entries that tell Windows which file implements a component.
Sources
Last reviewed: 19 October 2026.
