EUVD-2025-20540Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | Can lead to privilege escalation, data corruption, or bypassing of security checks depending on the context of the race. With a CVSS score of 7.0 (HIGH), this represents a significant risk. |
| Exploit ScenarioDerived | An attacker exploits a time-of-check-time-of-use (TOCTOU) window to modify a resource between when it's validated and when it's used. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 16, 2026
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Teams allows an authorized attacker to elevate privileges locally.
Earlier versions of this analysis (1)
RemediationAI
Use proper synchronization mechanisms (locks, mutexes, atomic operations). Implement file locking for filesystem operations. Avoid TOCTOU patterns.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
A race condition occurs when the behavior of software depends on the timing of events, such as the order of execution of threads or processes.
Know when Teams gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3Executive ViewAI
CVE-2025-49737 is a local privilege escalation vulnerability in Microsoft Teams that exploits a race condition in shared resource handling, allowing authenticated users with standard privileges to gain elevated system access. This directly impacts any organization running Teams on Windows endpoints where non-administrative users could exploit the flaw to access sensitive data or install malware with system-level permissions.
Apply vendor patch. Until patched, implement application control policies to restrict Teams process execution to administrative users only, and enforce Windows UAC (User Account Control) in strict mode to limit privilege escalation attack surface.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).
Privilege elevation in Microsoft Teams lets a remote, unauthenticated attacker gain unauthorized access across a network
Path-traversal-driven remote code execution affects the Microsoft Teams client for Android in all builds prior to 1.0.0.
A library injection vulnerability exists in Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. Rated criti
A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams (work or school) 24046.2813.27
A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work
Privilege elevation in Microsoft Teams allows an authenticated attacker with low-level access to bypass authentication c
Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to
Cross-site scripting in Microsoft Teams for Android (versions below 1.0.76.202611302) enables an authenticated attacker
Cryptographic signature spoofing in Microsoft Teams exposes enterprise collaboration environments to unauthenticated ide
The Microsoft Teams online service contains a stored cross-site scripting vulnerability in the displayName parameter tha
Microsoft Teams Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Teams Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
GitHub PoC
Exploit-DB