Vulnerabilidades do Microsoft 365 Copilot

CVE-2026-85887 Alta · 7.7 CWE-732 17/09/2026

M365 Copilot Information Disclosure Vulnerability

Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose information over a network.

CVE-2026-85885 Crítica · 9.9 CWE-77 17/09/2026

Microsoft 365 Copilot Elevation of Privilege Vulnerability

Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized attacker to elevate privileges over a network.

CVE-2026-50387 Alta · 7.8 CWE-121 14/07/2026

Windows GDI Elevation of Privilege Vulnerability

Stack-based buffer overflow in Windows GDI allows an authorized attacker to elevate privileges locally.

CVE-2026-47645 Alta · 8.8 CWE-601 19/06/2026

Microsoft 365 Copilot's Business Chat Elevation of Privilege Vulnerability

Url redirection to untrusted site ('open redirect') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-42895 Alta · 7.5 CWE-77 19/06/2026

Microsoft Copilot Tampering Vulnerability

Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network.

CVE-2026-54130 Alta · 7.5 CWE-306 18/06/2026

M365 Copilot Information Disclosure Vulnerability

Missing authentication for critical function in M365 Copilot allows an unauthorized attacker to disclose information over a network.

CVE-2026-45474 Alta · 8.4 CWE-787 09/06/2026

Microsoft Office Remote Code Execution Vulnerability

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

CVE-2026-45472 Alta · 8.4 CWE-787 09/06/2026

Microsoft Office Remote Code Execution Vulnerability

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

CVE-2026-45463 Alta · 8.4 CWE-121 09/06/2026

Microsoft Office Remote Code Execution Vulnerability

Integer underflow (wrap or wraparound) in Microsoft Office allows an unauthorized attacker to execute code locally.

CVE-2026-45461 Alta · 8.4 CWE-787 09/06/2026

Microsoft Office Remote Code Execution Vulnerability

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

CVE-2026-45460 Média · 4.7 CWE-126 09/06/2026

Microsoft Office Information Disclosure Vulnerability

Buffer over-read in Microsoft Office allows an unauthorized attacker to disclose information locally.

CVE-2026-45497 Alta · 8.8 CWE-77 04/06/2026

Microsoft M365 Copilot Remote Code Execution Vulnerability

Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an authorized attacker to execute code over a network.

CVE-2026-42824 Alta · 7.5 CWE-77 04/06/2026

M365 Copilot Information Disclosure Vulnerability

Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.

CVE-2026-42827 Alta · 7.5 CWE-77 22/05/2026

M365 Copilot Information Disclosure Vulnerability

Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.

CVE-2026-41090 Crítica · 9.3 CWE-77 22/05/2026

Microsoft Copilot Tampering Vulnerability

Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network.

CVE-2026-42831 Alta · 7.8 CWE-122 12/05/2026

Microsoft Office Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

CVE-2026-41614 Média · 6.2 CWE-284 12/05/2026

M365 Copilot for Desktop Spoofing Vulnerability

Improper access control in M365 Copilot for Desktop allows an unauthorized attacker to perform spoofing locally.

CVE-2026-41100 Média · 4.4 CWE-284 12/05/2026

Microsoft 365 Copilot for Android Spoofing Vulnerability

Improper access control in M365 Copilot allows an authorized attacker to perform spoofing locally.

CVE-2026-40363 Alta · 8.4 CWE-122 12/05/2026

Microsoft Office Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

CVE-2026-33102 Crítica · 9.3 CWE-601 23/04/2026

Microsoft 365 Copilot Elevation of Privilege Vulnerability

Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-24299 Média · 5.3 CWE-77 19/03/2026

M365 Copilot Information Disclosure Vulnerability

Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.

CVE-2026-26133 Alta · 7.1 CWE-77 16/03/2026

M365 Copilot Information Disclosure Vulnerability

AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.

CVE-2026-26134 Alta · 7.8 CWE-190 10/03/2026

Microsoft Office Elevation of Privilege Vulnerability

Integer overflow or wraparound in Microsoft Office allows an authorized attacker to elevate privileges locally.

CVE-2026-26110 Alta · 7.8 CWE-843 10/03/2026

Microsoft Office Remote Code Execution Vulnerability

Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.

CVE-2026-25180 Média · 5.5 CWE-125 10/03/2026

Windows Graphics Component Information Disclosure Vulnerability

Out-of-bounds read in Microsoft Graphics Component allows an unauthorized attacker to disclose information locally.