Summary
Impact: Spoofing. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
According to the CVSS metrics, successful exploitation of this vulnerability could lead to some loss of integrity (I:L)? What does that mean for this vulnerability?
An attacker's message can inherit the sender's email address from another message in the UI. The attacker cannot control which message it inherits from. This issue occurs exclusively for messages in the Junk folder, as it is the only folder where the app displays the sender's email address. The attacker cannot affect confidentiality or availability.
Security updates
4.2501.1 — https://learn.microsoft.com/en-us/officeupdates/release-notes-outlook-mobile
Vulnerabilities 1
-
Medium 5.3
Microsoft Outlook Spoofing Vulnerability
Microsoft Outlook Spoofing Vulnerability
Revision history
-
#1
Information published.
References
-
CVE-2025-21259 Microsoft Outlook Spoofing Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21259
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss