"We don't want to overvalue the issue. However, we do consider this issue a security vulnerability," Li wrote. "Our investigation shows that the samples were made and delivered by an 'email tracking service' provider. We don't know whether the issue has been abused for illegal or APT attacks."