You would need Teams installed AND an application that opens the malicious link. IE11 and Edge Legacy do that without prompting the user, other browsers display a confirmation dialog. There is a patch addressing the specific exploit path via MS Teams.

The underlying argument injection in LocalBridge.exe (which is the binary processing the JSON payload) is still present, which can be exploited to open other office apps with injected command line arguments. Someone might find another way to run arbitrary code using command line switches other than --gpu-launcher

>having teams installed (which is default in windows)

Teams is not default in Windows (at least my install) - I don't have it and when I have to do meetings in Teams and I am on my Windows machine I just open the meeting in Chrome.

Teams was installed without my approval on my private unmanaged laptop running Windows 10 Professional.

If you don't have Teams yet, you are either in another rollout, you have done something to prevent it or your PC is managed by someone who have prevented it somehow. I think that covers all.

As for why I only use Windows now and then and since I have had a habit of supporting others I keep my personal Windows PCs as plain as possible so I can see what others suffer (obviously I remove nagware like McAfee and make sure spyware like Chrome isn't set as default browser but I have gone as far as to voluntarily run my PC with Norwegian language).

I'm curious as to the effects of running with a Norwegian language with security. Any chance at enlightenment?

Sorry for the misunderstanding I created. The link between those two are how far I have gone to be able to help end users.

It is a bit tongue in cheek (since I am Norwegian) but only a bit since it is an extra hassle to try to mentally translate what translaters read in English when they created the unsearchable phrases that show up in a localized Windows version.

it needs edge or ie11 and teams. It doesn't appear to be a zero click without the use of edge or ie11 so just avoid both of those and you should be okay.

Easier said than done in many corporate environments unfortunately.