Criminals could start an attack by simply sending an email to users — without the need for the message to be opened or any attachments to be downloaded.
Source: CNet