Microsoft 365 Copilot CVE-2026-85885

CVE-2025-32711 is an AI command injection vulnerability in Microsoft 365 Copilot that enables unauthenticated network-ba

Microsoft Office app Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.6), this vulnerability is remo

M365 Copilot has an input validation vulnerability allowing unauthorized attackers to extract sensitive information thro

Privilege elevation in Microsoft 365 Copilot's Business Chat is possible when an attacker abuses an open redirect (CWE-6

Local code execution in Microsoft Office is possible via a heap-based buffer overflow that an unauthorized attacker can

Local code execution in Microsoft Office is possible through a heap-based buffer overflow that an unauthorized attacker

Local code execution in Microsoft Office via a heap-based buffer overflow allows an unauthorized attacker to run arbitra

Local code execution in Microsoft Office via a heap-based buffer overflow that lets an unauthorized attacker run arbitra

Information disclosure in Microsoft 365 Copilot allows an authenticated, low-privileged user within an affected tenant t

Command injection in Microsoft 365 Copilot lets a remote, unauthenticated attacker tamper with data and integrity over t

M365 Copilot is vulnerable to command injection that enables unauthenticated remote attackers to extract sensitive infor

Out-of-bounds read (buffer over-read) in Microsoft Office exposes sensitive memory contents to a local attacker who can