Microsoft 365_copilot
51 CVEs affecting Microsoft 365_copilot. Latest disclosed: 2026-07-14. Critical: 10, High: 32.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-54130 | Critical | 9.8 | 2026-06-18 | Missing authentication for critical function in M365 Copilot allows an unauthorized attacker to disclose information over a network. |
CVE-2025-60724 | Critical | 9.8 | 2025-11-11 | Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network. |
CVE-2025-53766 | Critical | 9.8 | 2025-08-12 | Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network. |
CVE-2026-48561 | Critical | 9.6 | 2026-07-14 | Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to execute code over a… |
CVE-2021-43905 | Critical | 9.6 | 2021-12-15 | Microsoft Office app Remote Code Execution Vulnerability |
CVE-2026-41106 | Critical | 9.3 | 2026-07-02 | Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-41090 | Critical | 9.3 | 2026-05-22 | Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to perform tampering o… |
CVE-2026-33102 | Critical | 9.3 | 2026-04-23 | Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-24307 | Critical | 9.3 | 2026-01-22 | Improper validation of specified type of input in M365 Copilot allows an unauthorized attacker to disclose information over a network. |
CVE-2025-32711 | Critical | 9.3 | 2025-06-11 | Ai command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network. |
CVE-2026-47645 | High | 8.8 | 2026-06-19 | Url redirection to untrusted site ('open redirect') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to elevate privileges over a netwo… |
CVE-2026-45474 | High | 8.4 | 2026-06-09 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2026-45472 | High | 8.4 | 2026-06-09 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2026-45463 | High | 8.4 | 2026-06-09 | Integer underflow (wrap or wraparound) in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2026-45461 | High | 8.4 | 2026-06-09 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2026-40363 | High | 8.4 | 2026-05-12 | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2026-26110 | High | 8.4 | 2026-03-10 | Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2025-62557 | High | 8.4 | 2025-12-09 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2025-62554 | High | 8.4 | 2025-12-09 | Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2025-49697 | High | 8.4 | 2025-07-08 | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. |