CVE-20XX-?

Microsoft 365 Copilot CVEs.

Published CVEs affecting Microsoft 365 Copilot, ranked by exploit odds.

30 CVEs · updated 2026-11-06 03:02 UTC

  1. CVE-2025-32711

    Ai command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.

    Microsoft 365 Copilot

    9.3 CRITICAL 9% exploit odds Fix listed
  2. CVE-2025-53766

    Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.

    Microsoft 365 Copilot

    9.8 CRITICAL 8% exploit odds Fix listed
  3. CVE-2025-60724

    Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.

    Microsoft 365 Copilot

    9.8 CRITICAL 6% exploit odds Fix listed
  4. CVE-2025-30388

    Heap-based buffer overflow in Windows Win32K - GRFX allows an unauthorized attacker to execute code locally.

    Microsoft 365 Copilot

    7.8 HIGH 4% exploit odds Fix listed
  5. CVE-2026-50517

    Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network.

    Code execution Microsoft 365 Copilot

    9.9 CRITICAL 2% exploit odds Fix listed
  6. CVE-2025-26687

    Use after free in Windows Win32K - GRFX allows an unauthorized attacker to elevate privileges over a network.

    Microsoft 365 Copilot

    7.5 HIGH 1% exploit odds Fix listed
  7. CVE-2026-54130

    Missing authentication for critical function in M365 Copilot allows an unauthorized attacker to disclose information over a network.

    Auth & access Microsoft 365 Copilot

    9.8 CRITICAL 1% exploit odds Fix listed
  8. CVE-2026-24307

    Improper validation of specified type of input in M365 Copilot allows an unauthorized attacker to disclose information over a network.

    Other Microsoft 365 Copilot

    9.3 CRITICAL 0.9% exploit odds Fix listed
  9. CVE-2026-48561

    Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to execute code over a network.

    Injection Browser & mail Microsoft 365 Copilot

    9.6 CRITICAL 0.9% exploit odds Fix listed
  10. CVE-2025-53799

    Use of uninitialized resource in Windows Imaging Component allows an unauthorized attacker to disclose information locally.

    Microsoft 365 Copilot

    5.5 MEDIUM 0.8% exploit odds Fix listed
  11. CVE-2026-85887

    Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose information over a network.

    Other Microsoft 365 Copilot

    7.7 HIGH 0.8% exploit odds Fix listed
  12. CVE-2026-58617

    Improper access control in Microsoft 365 Copilot for iOS allows an unauthorized attacker to elevate privileges over a network.

    Auth & access Device Microsoft 365 Copilot

    8.1 HIGH 0.8% exploit odds Fix listed
  13. CVE-2026-24299

    Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.

    Injection Microsoft 365 Copilot

    5.3 MEDIUM 0.8% exploit odds Fix listed
  14. CVE-2026-47645

    Url redirection to untrusted site ('open redirect') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to elevate privileges over a network.

    Other Microsoft 365 Copilot

    8.8 HIGH 0.8% exploit odds Fix listed
  15. CVE-2026-25180

    Out-of-bounds read in Microsoft Graphics Component allows an unauthorized attacker to disclose information locally.

    Memory safety Microsoft 365 Copilot

    5.5 MEDIUM 0.7% exploit odds Fix listed
  16. CVE-2026-85885

    Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized attacker to elevate privileges over a network.

    Injection Microsoft 365 Copilot

    9.9 CRITICAL 0.7% exploit odds Fix listed
  17. CVE-2026-41106

    Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network.

    Other Microsoft 365 Copilot

    9.3 CRITICAL 0.7% exploit odds Fix listed
  18. CVE-2026-42895

    Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network.

    Injection Microsoft 365 Copilot

    6.5 MEDIUM 0.7% exploit odds Fix listed
  19. CVE-2026-85881

    Stack-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges over a network.

    Memory safety Microsoft 365 Copilot

    8.0 HIGH 0.7% exploit odds Fix listed
  20. CVE-2026-42827

    Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.

    Injection Microsoft 365 Copilot

    6.5 MEDIUM 0.5% exploit odds Fix listed
  21. CVE-2025-53732

    Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

    Microsoft 365 Copilot

    7.8 HIGH 0.5% exploit odds Fix listed
  22. CVE-2026-24285

    Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.

    Memory safety OS & kernel Microsoft 365 Copilot

    7.0 HIGH 0.5% exploit odds Fix listed
  23. CVE-2026-26133

    AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.

    Injection Microsoft 365 Copilot

    7.1 HIGH 0.4% exploit odds Fix listed
  24. CVE-2026-42831

    Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

    Memory safety Microsoft 365 Copilot

    7.8 HIGH 0.4% exploit odds Fix listed
  25. CVE-2026-41090

    Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network.

    Injection Microsoft 365 Copilot

    9.3 CRITICAL 0.4% exploit odds Fix listed
  26. CVE-2026-33102

    Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network.

    Other Web app Microsoft 365 Copilot

    9.3 CRITICAL 0.4% exploit odds Fix listed
  27. CVE-2026-26134

    Integer overflow or wraparound in Microsoft Office allows an authorized attacker to elevate privileges locally.

    Memory safety Microsoft 365 Copilot

    7.8 HIGH 0.4% exploit odds Fix listed
  28. CVE-2026-41614

    Improper access control in M365 Copilot for Desktop allows an unauthorized attacker to perform spoofing locally.

    Auth & access Microsoft 365 Copilot

    6.2 MEDIUM 0.4% exploit odds Fix listed
  29. CVE-2026-50387

    Stack-based buffer overflow in Windows GDI allows an authorized attacker to elevate privileges locally.

    Memory safety OS & kernel Microsoft 365 Copilot

    7.8 HIGH 0.3% exploit odds Fix listed
  30. CVE-2026-41100

    Improper access control in M365 Copilot allows an authorized attacker to perform spoofing locally.

    Auth & access Microsoft 365 Copilot

    4.4 MEDIUM 0.2% exploit odds Fix listed

All CVEs affecting Microsoft 365 Copilot that appear in CVE.org and NVD, sorted by how likely they are to be exploited (EPSS), with fix status and timeline.