EUVD-2026-56290
GHSA-pcpc-w22h-9cxr
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-delivered content with low complexity and no attacker privileges, but a mobile chat-client RCE realistically needs the victim to receive/render the payload, so UI:R rather than the vendor's UI:N; impacts total.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Teams for Android allows an unauthorized attacker to execute code over a network.
AnalysisAI
Path-traversal-driven remote code execution affects the Microsoft Teams client for Android in all builds prior to 1.0.0.2026133602, where improper restriction of pathnames (CWE-22) lets an unauthorized attacker escape the app's restricted directory and execute code over the network. Microsoft rates it CVSS 9.8, but real-world signals are muted: EPSS is 0.62% (47th percentile), CISA SSVC records exploitation status as 'none', and there is no public exploit identified at time of analysis. A vendor patch is available, making prompt client updates the decisive control.
Technical ContextAI
The affected component is the Microsoft Teams messaging/collaboration application running on Android (cpe:2.3:a:microsoft:teams:*:*:*:*:*:android:*:*), not the desktop or web client. The root cause is CWE-22 (path traversal): the app fails to properly canonicalize or constrain a supplied pathname, allowing sequences such as '../' to reference locations outside the intended restricted storage directory. On Android, escaping the app's sandboxed private storage can allow an attacker-controlled file to be written to or read from an unexpected location; when a written path lands somewhere the app later loads or executes, this becomes the code-execution primitive Microsoft describes. The 'over a network' characterization fits Teams' architecture, where content (messages, attachments, shared files) is delivered remotely and then processed locally by the mobile client.
RemediationAI
Vendor-released patch: 1.0.0.2026133602 - update Microsoft Teams for Android to version 1.0.0.2026133602 or later, which is the primary and fully effective fix. In managed fleets, push the update through Managed Google Play / your MDM (Intune) and enforce a minimum app version so out-of-date clients are blocked from corporate data; in unmanaged/BYOD environments, ensure Google Play auto-update is enabled and communicate the required version to users. No specific vendor workaround is published; if patching must be delayed, compensating controls include restricting Teams access from non-compliant devices via Conditional Access app-version policies (side effect: blocks legitimate users on old builds) and limiting exposure to untrusted external messaging/federation until clients are updated (side effect: disrupts external collaboration). Consult the MSRC advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65768) for the definitive fixed build and any platform-specific notes.
Privilege elevation in Microsoft Teams lets a remote, unauthenticated attacker gain unauthorized access across a network
A library injection vulnerability exists in Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. Rated criti
A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams (work or school) 24046.2813.27
A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work
Privilege elevation in Microsoft Teams allows an authenticated attacker with low-level access to bypass authentication c
Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to
Cross-site scripting in Microsoft Teams for Android (versions below 1.0.76.202611302) enables an authenticated attacker
Cryptographic signature spoofing in Microsoft Teams exposes enterprise collaboration environments to unauthenticated ide
The Microsoft Teams online service contains a stored cross-site scripting vulnerability in the displayName parameter tha
Microsoft Teams Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Teams Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Information disclosure in Microsoft Teams for Android allows an authenticated remote attacker to extract sensitive data
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today