Microsoft 365 Copilot vulnerabilities
49 vulnerabilities
Known vulnerabilities in Microsoft 365 Copilot, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2021-43905microsoft365_copilot+1
EPSS score2.98%
Microsoft Office app Remote Code Execution VulnerabilityCVE-2025-59234microsoft365_apps+11EPSS score0.60%
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-59227microsoft365_apps+11EPSS score0.52%
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-62554microsoft365_apps+11EPSS score0.43%
Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-62557microsoft365_apps+11EPSS score0.43%
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-62199microsoft365_apps+10EPSS score0.81%
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-26687microsoft365_copilot+38EPSS score1.14%
Use after free in Windows Win32K - GRFX allows an unauthorized attacker to elevate privileges over a network.CVE-2025-47162microsoft365_apps+11EPSS score0.76%
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-47164microsoft365_apps+11EPSS score0.65%
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-47167microsoft365_apps+11EPSS score0.67%
Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-47953microsoft365_apps+11EPSS score0.54%
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-53766microsoft365_copilot+38EPSS score8.19%
Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.CVE-2025-53799microsoft365_copilot+36EPSS score0.78%
Use of uninitialized resource in Windows Imaging Component allows an unauthorized attacker to disclose information locally.CVE-2025-53732microsoft365_copilot+3EPSS score0.48%
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-49695microsoft365_apps+11EPSS score0.69%
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-49697microsoft365_apps+12EPSS score0.53%
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-49696microsoft365_apps+11EPSS score0.64%
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-49702microsoft365_apps+11EPSS score0.66%
Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-32711microsoft365_copilot+1EPSS score8.03%
Ai command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.CVE-2025-30386microsoft365_apps+11EPSS score0.68%
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.