Read the docs
TI-2019-00939 Aliases CVE-2019-1218GHSA-m3wq-w5qf-gpqg

Outlook iOS Spoofing Vulnerability

Priority LOW 31CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

A spoofing vulnerability exists in the way Microsoft Outlook iOS software parses specifically crafted email messages. An authenticated attacker could exploit the vulnerability by sending a specially crafted email message to a victim. The attacker who successfully exploited this vulnerability could then perform cross-site scripting attacks on the affected systems and run scripts in the security context of the current user. The security update addresses the vulnerability by correcting how Outlook iOS parses specially crafted email messages.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.03879 90th percentileScored 2026-11-07
Fix Fixed Outlook for iOS (Microsoft): publication

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftOutlook for iOSbefore publicationpublicationPatch availableCNA
  • Outlook for iOS VendorMicrosoft Affected before publication Fixed in publication Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:outlook:-:*:*:*:*:iphone_os:*:*not specified by NVDVulnerableMicrosoft
  • cpe:2.3:a:microsoft:outlook:-:*:*:*:*:iphone_os:*:* Versions not specified by NVD Vulnerable ·Microsoft

Remediation

  • Fix · CNA Outlook for iOS (Microsoft) Fixed in publication

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-1218
  2. 2026-10-03 Alias added: GHSA-m3wq-w5qf-gpqg
  3. 2026-10-14 EPSS moved to the 90th–95th percentile

References

Patch 1

  • TI-2023-09240 Microsoft Outlook Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-17652 Microsoft Outlook Security Feature Bypass Vulnerability KEVCVSS 3.1HIGH 8.8
  • TI-2007-00655 Unspecified vulnerability in Microsoft Excel 2000, XP, 2003, and 2004 for Mac, and… KEVCVSS 3.1HIGH 8.8
  • TI-2017-08726 Memory corruption in Microsoft Outlook KEVCVSS 3.1HIGH 7.8
  • TI-2015-01471 Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1… KEVCVSS 3.1HIGH 7.8
  • TI-2006-04695 Stack-based buffer overflow in the Vector Graphics Rendering engine (vgx.dll), as used in… CVSS 2.0HIGH 9.3
See all 124 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences