Attachment parsing is the process of reading, unpacking, and interpreting a file that arrives in an email or other message. The parser checks the file format, extracts metadata, and hands content to the right viewer or engine. Common examples include archives, documents, images, PDFs, and office files.
It matters because parsers are trusted to handle untrusted input. A malicious attachment can abuse parsing bugs such as buffer overflows, memory corruption, unsafe decompression, or logic flaws in embedded objects and scripts. In real attacks, phishing emails often deliver files designed to trigger a parser before the user notices anything unusual. Defenders reduce this risk with patching, content filtering, sandboxing, file type restrictions, and disabling unnecessary preview or auto-open features. In products like Outlook, attachment parsing is a key attack surface because it sits directly on the path between incoming mail and code execution.