The vulnerability arises from improper neutralization of special elements used in commands within Microsoft 365 Copilot for iOS, which is defined as a command injection flaw (CWE‑77). An attacker who can supply unauthenticated input can cause the application to execute arbitrary system commands, enabling tampering with data, application functionality, or device state over a network. This directly translates to potential remote code execution, unauthorized modification, and compromise of the hosting iOS device.

Affected is Microsoft 365 Copilot for iOS, a Microsoft 365 feature available on iOS devices. No specific version information was supplied, so all deployments of the Copilot for iOS add‑on are potentially impacted until a patch is released.

The CVSS score of 9.3 indicates a critical severity. No EPSS score has been published, so the exploitation probability is currently unknown; however, the lack of KEV listing suggests no publicly known exploits yet. The description indicates the vulnerability can be abused over a network, implying the attack vector is remote. With a high severity score and the possibility of network‑based exploitation, the risk to affected environments remains significant until the vendor issues a fix.