23 matches found
CVE-2026-48561
CVE-2026-48561 concerns Microsoft Copilot and is described as an Improper neutralization of special elements used in a command (command injection) that allows remote code execution over a network. The CVSS 3.1 metrics from the source indicate a CRITICAL base score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/...
CVE-2025-32711
CVE-2025-32711 (EchoLeak) is a zero-click AI command-injection vulnerability in Microsoft 365 Copilot that enables unauthorized data disclosure via crafted emails. The issue stems from prompt-injection techniques exploited by Copilot’s retrieval/processing flow, allowing data exfiltration from Co...
CVE-2026-50517
CVE-2026-50517 describes a deserialization vulnerability in Microsoft 365 Copilot (M365 Copilot) that enables an authorized attacker to execute code over the network. The issue is triggered by deserializing untrusted data, with a critical CVSS v3.1 score (9.9, CRITICAL) and a network attack vecto...
CVE-2026-54130
CVE-2026-54130 affects M365 Copilot and involves missing authentication for a critical function, enabling an unauthorized attacker to disclose information over a network. The NVD and CVE records confirm the root cause as unauthenticated access to a high-impact function, with a CVSS v3.1 base scor...
CVE-2025-47162
CVE-2025-47162 (Microsoft Office RCE) : A heap-based buffer overflow in Microsoft Office enables an attacker to execute arbitrary code locally. Public details list this as a local-exploitation vulnerability with no user interaction required (per the CVE description and Microsoft’s MSRC page). Aff...
CVE-2024-38250
CVE-2024-38250 is a Windows Graphics Component elevation-of-privilege vulnerability. The CVE entry (Microsoft product area) indicates a local attacker with low privileges and no user interaction could obtain higher privileges (CVSS 7.8, High). Connected sources corroborate that Microsoft has issu...
CVE-2025-47164
CVE-2025-47164 is a Microsoft Office remote code execution vulnerability described as a use-after-free condition in Office components. The affected suite includes Word, Excel, PowerPoint, Outlook, and SharePoint Server (various Office 2016/2019/2021 and related platforms), with the root cause ide...
CVE-2025-47953
CVE-2025-47953 is a Microsoft Office remote code execution vulnerability described as a use-after-free in Microsoft Office that could allow a local attacker to execute arbitrary code. Microsoft attributes a high severity (CVSSv3.1: 8.4, LOCAL access, no user interaction required) and notes impact...
CVE-2026-24299
CVE-2026-24299 affects M365 Copilot. The vulnerability is an improper neutralization of special elements used in a command (command injection) that could allow an unauthenticated attacker to disclose information over a network. According to the connected MSRC entry, the exploit would be delivered...
CVE-2025-49702
CVE-2025-49702 is a Microsoft Office remote code execution vulnerability caused by type confusion in Office functionality. The issue enables an attacker to run arbitrary code locally when a user opens a malicious file; Microsoft attributes a high base CVSS v3.1 score (7.8, HIGH) with LOCAL access...
CVE-2025-49695
CVE-2025-49695 is a Microsoft Office remote code execution/use-after-free vulnerability affecting Office components (notably Office 2016 and related suites). The issue enables local code execution when a user opens or previews crafted content; Microsoft lists updates (e.g., KB5002742) and multipl...
CVE-2025-49697
CVE-2025-49697 is a Microsoft Office remote code execution vulnerability. The issue is described as a heap-based buffer overflow in Office that allows an attacker with local access to run arbitrary code on a vulnerable system, with no user interaction required (local access, no UI). Publicly avai...
CVE-2026-41090
CVE-2026-41090 affects Microsoft Copilot. The vulnerability arises from improper neutralization of elements used in a command (command injection) that enables tampering over a network. The CVSS‑3.1 vector indicates network attack, high confidentiality and integrity impact, no availability impact,...
CVE-2025-49696
CVE-2025-49696 affects Microsoft Office (Office components) with an out-of-bounds read that enables a locally authenticated attacker to execute arbitrary code. Affected products include Microsoft Office 2016/2019/365-related suites and components such as Word, Excel, PowerPoint, and related Offic...
CVE-2026-42827
CVE-2026-42827 concerns a command injection vulnerability in Microsoft 365 Copilot. The Red Hat, NVD, MSRC, and other feeds describe improper neutralization of special elements used in a command, enabling an attacker to disclose information over a network. Affected product is Microsoft 365 Copilo...
CVE-2026-42895
Microsoft Copilot vulnerability CVE-2026-42895 involves improper neutralization of special elements used in a command (command injection) that could allow an unauthorized attacker to tamper with data over a network. Affected component is Microsoft Copilot; root cause is improper input handling le...
CVE-2025-62554
CVE-2025-62554 is a Microsoft Office remote code execution vulnerability reported as a type confusion in Office components. Multiple connected sources (MSRC, CNVD, EUVD, CNNVD, Krebs) describe it as enabling code execution on affected systems, with Microsoft noting the issue in Office products an...
CVE-2026-47645
Summary: CVE-2026-47645 is an open redirect vulnerability in Microsoft 365 Copilot’s Business Chat that can lead to privilege escalation over a network. The issue is described across sources (NVD/MSRC/CVE records) as a url redirection to an untrusted site, with a CVSS v3.1 base score of 8.8 (HIGH...
CVE-2026-45460
CVE-2026-45460 is an information-disclosure vulnerability in Microsoft Office caused by an out-of-bounds read in a Microsoft Office component. It allows a local, unauthenticated attacker to disclose information (confidentiality impact). The CVSSv3.1 metrics indicate a Local attack vector, High ex...
CVE-2025-62557
CVE-2025-62557 is a Microsoft Office remote-code-execution vulnerability (use-after-free) affecting Office components; exploitation could allow local code execution with high impact. Connected sources identify Microsoft Office as affected and confirm a code-execution vector via Office. Remediatio...
CVE-2026-24307
CVE-2026-24307 affects M365 Copilot. Root cause: improper validation of a specified input type. Impact: unauthorized disclosure of information over a network (confidentiality and integrity high; CVSS 9.3). Exploitation details are not provided in the supplied documents. Remediation is expected vi...