Microsoft 365 Copilot vulnerabilities, page 2
49 vulnerabilities
Known vulnerabilities in Microsoft 365 Copilot, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2025-30388microsoft365_copilot+41
EPSS score4.38%
Heap-based buffer overflow in Windows Win32K - GRFX allows an unauthorized attacker to execute code locally.CVE-2025-60724microsoft365_copilot+37EPSS score6.29%
Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.CVE-2024-38250microsoft365_copilot+39EPSS score0.69%
Windows Graphics Component Elevation of Privilege VulnerabilityCVE-2026-54130microsoft365_copilot+1EPSS score1.08%
Missing authentication for critical function in M365 Copilot allows an unauthorized attacker to disclose information over a network.CVE-2026-40363microsoft365_apps+11EPSS score0.36%
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2026-41106microsoft365_copilot+1EPSS score0.72%
Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network.CVE-2026-41090microsoft365_copilot+1EPSS score0.76%
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network.CVE-2026-41614microsoft365_copilot+1EPSS score0.40%
Improper access control in M365 Copilot for Desktop allows an unauthorized attacker to perform spoofing locally.CVE-2026-41100microsoft365_copilot+6EPSS score0.26%
Improper access control in M365 Copilot allows an authorized attacker to perform spoofing locally.CVE-2026-26133microsoft365_copilot+29EPSS score0.56%
AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.CVE-2026-26110microsoft365_apps+11EPSS score0.35%
Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2026-26134microsoft365_copilot+1EPSS score0.35%
Integer overflow or wraparound in Microsoft Office allows an authorized attacker to elevate privileges locally.CVE-2026-47645microsoft365_copilot+1EPSS score0.76%
Url redirection to untrusted site ('open redirect') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to elevate privileges over a network.CVE-2026-42895microsoft365_copilot+1EPSS score0.71%
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network.CVE-2026-42827microsoft365_copilot+1EPSS score0.92%
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.CVE-2026-42831microsoft365_copilot+5EPSS score0.47%
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2026-48561microsoft365_copilot+2EPSS score0.86%
Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to execute code over a network.CVE-2026-25180microsoft365_copilot+31EPSS score0.68%
Out-of-bounds read in Microsoft Graphics Component allows an unauthorized attacker to disclose information locally.CVE-2026-58617microsoft365_copilot+1EPSS score0.79%
Improper access control in Microsoft 365 Copilot for iOS allows an unauthorized attacker to elevate privileges over a network.CVE-2026-24299microsoft365_copilot+1EPSS score0.66%
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.