Read the docs
TI-2019-00835 Aliases CVE-2019-1105GHSA-g48p-gv5g-mvv6

Outlook for Android Spoofing Vulnerability

Priority LOW 28CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from Microsoft.

Summary

A spoofing vulnerability exists in the way Microsoft Outlook for Android software parses specifically crafted email messages. An authenticated attacker could exploit the vulnerability by sending a specially crafted email message to a victim. The attacker who successfully exploited this vulnerability could then perform cross-site scripting attacks on the affected systems and run scripts in the security context of the current user. The security update addresses the vulnerability by correcting how Outlook for Android parses specially crafted email messages.

Why it matters now

EPSS 0.01817 78th percentileScored 2026-11-07
Fix Fixed Microsoft Outlook for Android (Microsoft): Publication

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftMicrosoft Outlook for Android1.0 to before PublicationPublicationPatch availableCNA
  • Microsoft Outlook for Android VendorMicrosoft Affected 1.0 to before Publication Fixed in Publication Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:outlook:*:*:*:*:*:android:*:*all versionsVulnerableMicrosoft
  • cpe:2.3:a:microsoft:outlook:*:*:*:*:*:android:*:* Versions all versions Vulnerable ·Microsoft

Remediation

  • Fix · CNA Microsoft Outlook for Android (Microsoft) Fixed in Publication

Vendor assessments

Microsoft

Microsoft's page for this CVE →

Impact
Spoofing
Exploited
No
Publicly disclosed
No
Exploitability
Exploitation More Likely
ProductStatusPlan or fix
Microsoft Outlook for AndroidFixed Publication · Security Update

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-1105
  2. 2026-10-03 Alias added: GHSA-g48p-gv5g-mvv6

References

Patch 1

Advisory 1

  • TI-2023-09240 Microsoft Outlook Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-17652 Microsoft Outlook Security Feature Bypass Vulnerability KEVCVSS 3.1HIGH 8.8
  • TI-2007-00655 Unspecified vulnerability in Microsoft Excel 2000, XP, 2003, and 2004 for Mac, and… KEVCVSS 3.1HIGH 8.8
  • TI-2017-08726 Memory corruption in Microsoft Outlook KEVCVSS 3.1HIGH 7.8
  • TI-2015-01471 Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1… KEVCVSS 3.1HIGH 7.8
  • TI-2006-04695 Stack-based buffer overflow in the Vector Graphics Rendering engine (vgx.dll), as used in… CVSS 2.0HIGH 9.3
See all 124 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences