A spoofing bug (CVE-2019-1105) can open the door to an email attack chain.
Source: Threadpost