The vulnerability resides in Microsoft UFO’s constellation client, which tracks pending tasks solely by session_id and ignores the binding to the originating device. An authenticated peer device can therefore send a forged TASK_END message with a session_id that matches a victim’s pending Future. The constellation client accepts the message and completes the victim’s task with attacker‑controlled result data. This allows the attacker to inject arbitrary results into tasks executed by other devices, compromising data integrity and potentially exploiting application logic that trusts task outcomes.

Affected product: Microsoft UFO, version 3.0.1-4-ge2626659. The flaw is present in the constellation client component of that release. Devices running this version of the framework are susceptible to cross‑device task‑result injection if they communicate with a constellation server that does not enforce device‑ID verification on TASK_END messages.

The CVSS score of 5.9 indicates a moderate severity, and the EPSS score is not available, so the likelihood of exploitation in the wild is uncertain. The flaw is not listed in CISA’s KEV catalog. Exploitation requires that the attacker has valid credentials on a peer device connected to the same constellation, allowing them to send forged TASK_END messages. Once such a message is accepted, the attacker can inject crafted results, potentially affecting downstream processes that rely on those results.