Improper neutralization of special elements used in a command string provided by M365 Copilot can lead to command injection. When an unauthorized attacker supplies specially crafted input it may cause the Outlook for iOS application to execute arbitrary commands, which can in turn modify or tamper with data over the network. The primary impact is the potential for a malicious actor to alter or disrupt content through these injected commands.

Microsoft Outlook for iOS on iPhone OS is the identified product. No specific affected versions are listed in the CNA data, so all installations of the application are potentially vulnerable until a patch is applied.

The CVSS score of 7.4 indicates a high severity risk, but the EPSS score is unavailable and the vulnerability is not listed in CISA KEV. Based on the description, the attack vector is likely remote, via network traffic that interacts with Outlook for iOS. An attacker must be able to supply input that reaches the vulnerable command processing routine, possibly by using features enabled by M365 Copilot. While the exact conditions for exploitation are not fully detailed, the existence of a command injection flaw suggests that if an attacker can influence input, they can execute arbitrary commands and tamper with data.