This vulnerability, identified as CWE-284 (Improper Access Control), affects Microsoft M365 Copilot for Desktop version 1.0.0. It enables a local attacker without privileges to spoof identities or actions within the application due to insufficient access control mechanisms. The CVSS 3.1 base score is 6.2, reflecting local attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact. Microsoft has published an official fix for this vulnerability, as detailed in their security update guide.

An unauthorized local attacker can exploit this vulnerability to perform spoofing, potentially misleading users or systems about the origin or authenticity of actions or data. The confidentiality impact is high, but integrity and availability are not affected. This could lead to trust issues or unauthorized information disclosure within the affected application.

Microsoft has released an official fix for this vulnerability. Users and administrators should apply the provided patch promptly to remediate the issue. Refer to the Microsoft security update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41614 for detailed patching instructions.