A high-severity vulnerability could allow cybercriminals to push malware or remotely execute code, using seemingly innocuous messages.