Microsoft announces that Outlook on the web and the new Outlook for Windows will no longer display embedded SVG images because they are being used in cyberattacks.
The rollout of the new security measure began in early September 2025 and is expected to be completed for all users by mid-October 2025.
The company notes that these changes will affect less than 0.1% of all images sent via Outlook, so the actual impact on users after the rollout is complete should be minimal.
“Embedded SVG images will no longer be displayed in the web version of Outlook and the new Outlook for Windows. Instead, users will see empty placeholders where these images should have appeared,” the company said. “SVG images sent as regular attachments will still be supported and displayed via the attachment pane. This update is intended to reduce potential security risks, such as cross-site scripting (XSS) attacks.”
In recent years, attackers have indeed actively used SVG (Scalable Vector Graphics) files to spread malware and display phishing forms.
For instance, at the end of 2024, infosec specialists warned that attackers were increasingly attaching SVG-format files to their emails, helping them evade detection. In April 2025, Trustwave experts reported that attacks using SVG had shifted toward phishing campaigns and showed a 1,800% increase since April 2024.
Finally, just recently, at the end of September 2025, Microsoft uncovered a malicious campaign that used SVG files generated with an LLM to evade email security.
Stopping the display of embedded SVG images in Microsoft Outlook is part of a broader strategy to remove or disable Office and Windows features that attackers exploit in attacks against users of Microsoft products.
For example, in June of this year Microsoft announced that the web version of Outlook and the new Outlook for Windows will block files with the .library-ms and .search-ms. extensions. These file types were previously used in attacks against government organizations and exploited in malicious campaigns since at least June 2022.
The full list of Outlook blocked attachments is available on the Microsoft website.