Microsoft 365 Copilot vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Microsoft 365 Copilot: 37 record(s), with affected versions and fixes.cpe:2.3:a:microsoft:365_copilot
CVE-2026-26133
High · 7.1
CWE-77 Mar 16, 2026
M365 Copilot Information Disclosure Vulnerability
AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.
CVE-2026-26134
High · 7.8
CWE-190 Mar 10, 2026
Microsoft Office Elevation of Privilege Vulnerability
Integer overflow or wraparound in Microsoft Office allows an authorized attacker to elevate privileges locally.
CVE-2026-26110
High · 7.8
CWE-843 Mar 10, 2026
Microsoft Office Remote Code Execution Vulnerability
Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
CVE-2026-25180
Medium · 5.5
CWE-125 Mar 10, 2026
Windows Graphics Component Information Disclosure Vulnerability
Out-of-bounds read in Microsoft Graphics Component allows an unauthorized attacker to disclose information locally.
CVE-2026-24285
High · 7.0
CWE-416 Mar 10, 2026
Win32k Elevation of Privilege Vulnerability
Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.
CVE-2026-24307
High · 7.5
CWE-1287 Jan 22, 2026
M365 Copilot Information Disclosure Vulnerability
Improper validation of specified type of input in M365 Copilot allows an unauthorized attacker to disclose information over a network.
CVE-2025-62557
High · 7.8
CWE-416 Dec 9, 2025
Microsoft Office Remote Code Execution Vulnerability
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
CVE-2025-62554
High · 7.8
CWE-843 Dec 9, 2025
Microsoft Office Remote Code Execution Vulnerability
Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
CVE-2025-62199
High · 7.8
CWE-416 Nov 11, 2025
Microsoft Office Remote Code Execution Vulnerability
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
CVE-2025-60724
Critical · 9.8
CWE-122 Nov 11, 2025
GDI+ Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.
CVE-2025-59234
High · 7.8
CWE-416 Oct 14, 2025
Microsoft Office Remote Code Execution Vulnerability
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
CVE-2025-59227
High · 7.8
CWE-416 Oct 14, 2025
Microsoft Office Remote Code Execution Vulnerability
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.