Read the docs
TI-2025-31706 Aliases CVE-2025-49737GHSA-cfpx-rr6v-gv66

Microsoft Teams Elevation of Privilege Vulnerability

Priority LOW 32CWE-362Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from Microsoft.

Summary

Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Teams allows an authorized attacker to elevate privileges locally.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00212 11th percentileScored 2026-11-07
Fix Fixed Microsoft Teams for Mac, New Edition (Microsoft): 25163.3001.3726.6503

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftMicrosoft Teams for Mac, New Edition1.0.0.0 to before 25163.3001.3726.650325163.3001.3726.6503Patch availableCNA
  • Microsoft Teams for Mac, New Edition VendorMicrosoft Affected 1.0.0.0 to before 25163.3001.3726.6503 Fixed in 25163.3001.3726.6503 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:teams:*:*:*:*:*:macos:*:*before 25163.3001.3726.6503VulnerableMicrosoft
  • cpe:2.3:a:microsoft:teams:*:*:*:*:*:macos:*:* Versions before 25163.3001.3726.6503 Vulnerable ·Microsoft

Remediation

  • Fix · CNA Microsoft Teams for Mac, New Edition (Microsoft) Fixed in 25163.3001.3726.6503

Vendor assessments

Microsoft

Microsoft's page for this CVE →

Impact
Elevation of Privilege
Exploited
No
Publicly disclosed
No
Exploitability
Exploitation Less Likely
ProductStatusPlan or fix
Microsoft Teams for Mac, New EditionFixed 25163.3001.3726.6503 · Security Update

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-49737
  2. 2026-10-03 Alias added: GHSA-cfpx-rr6v-gv66

References

Patch 1

  • TI-2023-04477 Out-of-bounds write in Google Chrome KEVCVSS 3.1HIGH 8.8
  • TI-2024-28020 Improper signature verification in Microsoft Teams CVSS 3.1CRITICAL 9.8
  • TI-2024-25478 Microsoft Teams for iOS Spoofing Vulnerability CVSS 3.1MEDIUM 6.5
  • TI-2026-46812 Microsoft Teams Elevation of Privilege Vulnerability CVSS 3.1CRITICAL 10.0
  • TI-2026-46862 Microsoft Teams Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2024-27489 Improper signature verification in Microsoft Teams CVSS 3.1CRITICAL 9.8
See all 30 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences