Microsoft 365 Copilot vulnerabilities

CVE-2025-60724 [CRITICAL] CWE-122 CVE-2025-60724: Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execut Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.

CVE-2025-53766 [CRITICAL] CWE-122 CVE-2025-53766: Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a ne Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.

CVE-2026-58617 [CRITICAL] CWE-284 CVE-2026-58617: Improper access control in Microsoft 365 Copilot for iOS allows an unauthorized attacker to elevate Improper access control in Microsoft 365 Copilot for iOS allows an unauthorized attacker to elevate privileges over a network.

CVE-2021-43905 [CRITICAL] CVE-2021-43905: Microsoft Office app Remote Code Execution Vulnerability Microsoft Office app Remote Code Execution Vulnerability

CVE-2026-40363 [HIGH] CWE-122 CVE-2026-40363: Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code local Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

CVE-2025-30388 [HIGH] CWE-122 CVE-2025-30388: Heap-based buffer overflow in Windows Win32K - GRFX allows an unauthorized attacker to execute code Heap-based buffer overflow in Windows Win32K - GRFX allows an unauthorized attacker to execute code locally.

CVE-2025-62199 [HIGH] CWE-416 CVE-2025-62199: Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

CVE-2025-59234 [HIGH] CWE-416 CVE-2025-59234: Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

CVE-2026-42831 [HIGH] CWE-122 CVE-2026-42831: Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code local Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

CVE-2025-47167 [HIGH] CWE-843 CVE-2025-47167: Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthor Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.

CVE-2026-26110 [HIGH] CWE-843 CVE-2026-26110: Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthor Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.

CVE-2025-59227 [HIGH] CWE-416 CVE-2025-59227: Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

CVE-2025-53732 [HIGH] CWE-122 CVE-2025-53732: Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code local Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

CVE-2026-26134 [HIGH] CWE-190 CVE-2026-26134: Integer overflow or wraparound in Microsoft Office allows an authorized attacker to elevate privileg Integer overflow or wraparound in Microsoft Office allows an authorized attacker to elevate privileges locally.

CVE-2025-30386 [HIGH] CWE-416 CVE-2025-30386: Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

CVE-2025-26687 [HIGH] CWE-416 CVE-2025-26687: Use after free in Windows Win32K - GRFX allows an unauthorized attacker to elevate privileges over a Use after free in Windows Win32K - GRFX allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-26133 [HIGH] CWE-77 CVE-2026-26133: AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.

CVE-2026-24285 [HIGH] CWE-416 CVE-2026-24285: Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally. Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.

CVE-2023-36565 [HIGH] CWE-416 CVE-2023-36565: Microsoft Office Graphics Elevation of Privilege Vulnerability Microsoft Office Graphics Elevation of Privilege Vulnerability

CVE-2026-41614 [MEDIUM] CWE-284 CVE-2026-41614: Improper access control in M365 Copilot for Desktop allows an unauthorized attacker to perform spoof Improper access control in M365 Copilot for Desktop allows an unauthorized attacker to perform spoofing locally.