Microsoft Teams

Aug 2026: Microsoft Teams for Android and iOS Spoofing Vulnerability
CVE-2026-65767 8.8 - High - August 11, 2026

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Teams for Android allows an authorized attacker to perform spoofing over a network.

XSS

Aug 2026: Microsoft Teams iOS Information Disclosure Vulnerability
CVE-2026-65769 6.5 - Medium - August 11, 2026

Exposure of sensitive information to an unauthorized actor in Microsoft Teams Mobile allows an unauthorized attacker to disclose information over a network.

Information Disclosure

Aug 2026: Microsoft Teams Remote Code Execution Vulnerability
CVE-2026-65768 8.8 - High - August 11, 2026

Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Teams for Android allows an unauthorized attacker to execute code over a network.

Directory traversal

Aug 2026: Microsoft Teams Elevation of Privilege Vulnerability
CVE-2026-65667 10 - Critical - August 06, 2026

Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network.

AuthZ

Aug 2026: Microsoft Teams Spoofing Vulnerability
CVE-2026-62918 7.5 - High - August 06, 2026

Improper verification of cryptographic signature in Microsoft Teams allows an unauthorized attacker to perform spoofing over a network.

Improper Verification of Cryptographic Signature

Aug 2026: Microsoft Teams Elevation of Privilege Vulnerability
CVE-2026-62896 9.6 - Critical - August 06, 2026

Improper authentication in Microsoft Teams allows an authorized attacker to elevate privileges over a network.

authentification

Jun 2026: Microsoft Teams for Android Information Disclosure Vulnerability
CVE-2026-42835 8.1 - High - June 09, 2026

Improper neutralization of special elements in output used by a downstream component ('injection') in Microsoft Teams for Android allows an authorized attacker to disclose information over a network.

Injection

May 2026: Microsoft Teams Spoofing Vulnerability
CVE-2026-32185 5.5 - Medium - May 12, 2026

Files or directories accessible to external parties in Microsoft Teams allows an unauthorized attacker to perform spoofing locally.

Files or Directories Accessible to External Parties

May 2026: Microsoft Team Events Portal Information Disclosure Vulnerability
CVE-2026-33823 9.6 - Critical - May 07, 2026

Improper authorization in Microsoft Teams allows an authorized attacker to disclose information over a network.

AuthZ

Mar 2026: M365 Copilot Information Disclosure Vulnerability
CVE-2026-26133 7.1 - High - March 13, 2026

AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.

Command Injection

Feb 2026: Microsoft Teams Information Disclosure Vulnerability
CVE-2026-21535 8.2 - High - February 19, 2026

Improper access control in Microsoft Teams allows an unauthorized attacker to disclose information over a network.

Authorization

Teams Admin Center Log Exposes Sensitive Data During Config Changes
CVE-2025-14432 - December 16, 2025

In limited scenarios, sensitive data might be written to the log file if an admin uses Microsoft Teams Admin Center (TAC) to make device configuration changes. The affected log file is visible only to users with admin credentials. This is limited to Microsoft TAC and does not affect configuration changes made using the provisioning server or the device WebUI.

Insertion of Sensitive Information into Log File

Aug 2025: Microsoft Teams Remote Code Execution Vulnerability
CVE-2025-53783 7.5 - High - August 12, 2025

Heap-based buffer overflow in Microsoft Teams allows an unauthorized attacker to execute code over a network.

Heap-based Buffer Overflow

Jul 2025: Microsoft Teams Elevation of Privilege Vulnerability
CVE-2025-49737 7 - High - July 08, 2025

Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Teams allows an authorized attacker to elevate privileges locally.

Race Condition

Jul 2025: Microsoft Teams Elevation of Privilege Vulnerability
CVE-2025-49731 3.1 - Low - July 08, 2025

Improper handling of insufficient permissions or privileges in Microsoft Teams allows an authorized attacker to elevate privileges over a network.

Improper Handling of Insufficient Permissions or Privileges

Microsoft Teams macOS Helper App Library Injection Vulnerability
CVE-2024-41138 7.1 - High - December 18, 2024

A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. A specially crafted library can leverage Teams's access privileges, leading to a permission bypass. A malicious application could inject a library and start the program to trigger this vulnerability and then make use of the vulnerable application's permissions.

Improper Verification of Cryptographic Signature

Microsoft Teams WebView.app Helper Library Injection Vulnerability
CVE-2024-41145 7.1 - High - December 18, 2024

A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. A specially crafted library can leverage Teams's access privileges, leading to a permission bypass. A malicious application could inject a library and start the program to trigger this vulnerability and then make use of the vulnerable application's permissions.

Improper Verification of Cryptographic Signature

Microsoft Teams Library Injection Vulnerability on macOS
CVE-2024-42004 7.1 - High - December 18, 2024

A library injection vulnerability exists in Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. A specially crafted library can leverage Teams's access privileges, leading to a permission bypass. A malicious application could inject a library and start the program to trigger this vulnerability and then make use of the vulnerable application's permissions.

Improper Verification of Cryptographic Signature

MS Teams iOS Spoofing Vulnerability (CVE-2024-38197)
CVE-2024-38197 6.5 - Medium - August 13, 2024

Microsoft Teams for iOS Spoofing Vulnerability

User Interface (UI) Misrepresentation of Critical Information

Microsoft Teams Android Info Disclosure via API Hardcode
CVE-2024-21448 5 - Medium - March 12, 2024

Microsoft Teams for Android Information Disclosure Vulnerability

Feb 2024: Microsoft Teams for Android Information Disclosure Vulnerability
CVE-2024-21374 5 - Medium - February 13, 2024

Microsoft Teams for Android Information Disclosure Vulnerability

Improper Input Validation

Microsoft Teams Race: Event Subsystem Use-After-Free in AV Calls
CVE-2023-38538 5 - Medium - October 04, 2023

A race condition in an event subsystem led to a heap use-after-free issue in established audio/video calls that could have resulted in app termination or unexpected control flow with very low probability.

Race Condition

Heap Buffer Overflow in libwebp (Chrome <116.0.5845.187 / libwebp 1.3.2)
CVE-2023-4863 8.8 - High - September 12, 2023

Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)

Memory Corruption

Aug 2023: Microsoft Teams Remote Code Execution Vulnerability
CVE-2023-29328 8.8 - High - August 08, 2023

Microsoft Teams Remote Code Execution Vulnerability

Dangling pointer

Aug 2023: Microsoft Teams Remote Code Execution Vulnerability
CVE-2023-29330 8.8 - High - August 08, 2023

Microsoft Teams Remote Code Execution Vulnerability

Dangling pointer

Teams Info Disclosure Vulnerability
CVE-2023-24881 6.5 - Medium - July 11, 2023

Microsoft Teams Information Disclosure Vulnerability

Open-Redirect via Feedback action in Microsoft Teams Admin
CVE-2022-38657 5.4 - Medium - February 12, 2023

An open redirect to malicious sites can occur when accessing the "Feedback" action on the manager page.

Open Redirect

Messaging Service Local DoS via Missing Permission Check (Teams)
CVE-2022-38687 5.5 - Medium - October 14, 2022

In messaging service, there is a missing permission check. This could lead to local denial of service in messaging service with no additional execution privileges needed.

AuthZ

Microsoft Teams Denial of Service Vulnerability
CVE-2022-21965 7.5 - High - February 09, 2022

Microsoft Teams Denial of Service Vulnerability

Microsoft Teams iOS Information Disclosure Vulnerability
CVE-2021-24114 5.7 - Medium - February 25, 2021

Microsoft Teams iOS Information Disclosure Vulnerability

The Microsoft Teams online service contains a stored cross-site scripting vulnerability in the displayName parameter
CVE-2020-10146 5.4 - Medium - December 09, 2020

The Microsoft Teams online service contains a stored cross-site scripting vulnerability in the displayName parameter that can be exploited on Teams clients to obtain sensitive information such as authentication tokens and to possibly execute arbitrary commands. This vulnerability was fixed for all Teams users in the online service on or around October 2020.

XSS

Nov 2020: Microsoft Teams Remote Code Execution Vulnerability
CVE-2020-17091 7.8 - High - November 11, 2020

Microsoft Teams Remote Code Execution Vulnerability

Code Injection

Untrusted search path vulnerability in The installer of Microsoft Teams
CVE-2019-5922 7.8 - High - March 12, 2019

Untrusted search path vulnerability in The installer of Microsoft Teams allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

Untrusted Path