This vulnerability (CVE-2026-41100) involves improper access control (CWE-284) in Microsoft 365 Copilot for Android version 1.0. It allows an authorized attacker with local access to perform spoofing attacks. The CVSS 3.1 base score is 4.4, reflecting low complexity and privileges required, no user interaction, and limited impact on confidentiality and integrity. Microsoft has released an official fix and manages remediation for this cloud-hosted service. No known active exploitation has been reported.

An authorized attacker with local access to the affected Microsoft 365 Copilot for Android version 1.0 can exploit this vulnerability to perform spoofing attacks, potentially misleading users or systems. The impact on confidentiality and integrity is limited, and there is no impact on availability. No known exploits are currently active in the wild.

Microsoft has released an official fix for this vulnerability. Since this is a cloud service, Microsoft manages the remediation server-side. Users and administrators should ensure their Microsoft 365 Copilot for Android service is updated according to Microsoft's guidance available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41100. No additional user action is required beyond applying the official fix.