Outlook for iOS EUVD-2026-29716

The fix is delivered in Microsoft Outlook for iOS 5.2617.1; all versions from 1.0.0 up to (but not including) 5.2617.1 are listed as affected by EUVD. The published CVSS vector (AV:N/AC:L/PR:N/UI:N) implies no authentication, no user interaction, and default-configuration exploitability, but the available sources do not describe the specific feature, protocol, or input that triggers the command injection, so the precise prerequisite cannot be stated with confidence. A key limiting/uncertainty factor is the product discrepancy: the Description attributes the flaw to 'M365 Copilot' while all structured metadata points to Outlook for iOS - defenders should confirm which component is actually affected with Microsoft MSRC before assessing exposure. Impact is confined to integrity/tampering (C:N/A:N).

The signals are broadly consistent and point to a moderate, non-urgent priority rather than an active threat. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated issue, but impact is integrity-only (C:N/I:H/A:N) - tampering, with no confidentiality or availability loss - which caps the base score at 7.5. Exploitation signals all point low: EPSS is 0.04% (14th percentile), SSVC reports Exploitation: none, Automatable: no, and only partial Technical Impact, and there is no CISA KEV listing and no public exploit identified. The vuln.today decision label is this_week, i.e. patch on a normal cycle, not an emergency. A material data conflict must be flagged: the Description names 'M365 Copilot', but the CPE, EUVD affected-version list, and tags all identify 'Microsoft Outlook for iOS' (before 5.2617.1) - these are different products, so the true affected component should be confirmed with Microsoft/MSRC before scoping. In addition, an unauthenticated network command-injection with UI:N against what the metadata says is a mobile mail client is unusual; the sources do not describe the trigger, so the no-user-interaction claim cannot be independently corroborated here.

A remote, unauthenticated attacker supplies crafted input that the affected application processes over the network, injecting special command elements (CWE-77) to tamper with integrity-protected data or behavior. Because the CVSS vector reports no privileges and no user interaction, the attacker needs no account or victim action per the published metrics, though the sources do not describe exactly how the flaw is triggered. No public exploit has been identified at the time of analysis, and EPSS/SSVC both indicate exploitation is currently unlikely.