“We determined that this issue does not require immediate security service and we assessed this as low severity for temporary DoS that requires restart of application.”
Teams’ link previews let an attacker reach internal Microsoft services, spoof where a link goes, leak Android users’ IP addresses and crash their app with one message. The researchers reported all four in March. Microsoft closed the tickets without a patch. Nine months later only the IP leak looked fixed. The DoS was rated low severity because you can just restart the app.