What is the CVSS score of EUVD-2025-20540?

EUVD-2025-20540 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Teams are affected by EUVD-2025-20540?

CVE-2025-49737 is a local privilege escalation vulnerability in Microsoft Teams that exploits a race condition in shared resource handling, allowing authenticated users with standard privileges to…. A patch is available.

How to fix or mitigate EUVD-2025-20540?

Within 24 hours: Identify all Windows systems running Microsoft Teams using your endpoint management tools and document current deployment versions. Within 7 days: Apply the latest Microsoft Teams security update (consult Microsoft security advisories for the specific patched version number for your Teams deployment channel). Within 30 days: Verify patch deployment across 100% of Teams-enabled endpoints through compliance scanning and confirm no systems remain on pre-patch versions.

Teams EUVD-2025-20540

| CVE-2025-49737 HIGH

Race Condition (CWE-362)

2025-07-08 secure@microsoft.com

Microsoft Race Condition Information Disclosure Teams

7.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:29 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

25163.3001.3726.6503

EUVD ID Assigned

Mar 16, 2026 - 04:21 euvd

EUVD-2025-20540

Analysis Generated

Mar 16, 2026 - 04:21 vuln.today

CVE Published

Jul 08, 2025 - 17:16 nvd

HIGH 7.0

DescriptionCVE.org

Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Teams allows an authorized attacker to elevate privileges locally.

Analysis

Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Teams allows an authorized attacker to elevate privileges locally.