Read the docs
TI-2025-33680 Aliases CVE-2025-53783GHSA-56v2-hh65-7486

Microsoft Teams Remote Code Execution Vulnerability

Priority LOW 37CWE-122Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from Microsoft.

Summary

Heap-based buffer overflow in Microsoft Teams allows an unauthorized attacker to execute code over a network.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00893 59th percentileScored 2026-11-07
Fix Fixed Microsoft Teams for Android (Microsoft): 1416/1.0.0.2025102802Microsoft Teams for Desktop (Microsoft): 25122.1415.3698.6812+6 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftMicrosoft Teams for Android1.0.0 to before 1416/1.0.0.20251028021416/1.0.0.2025102802Patch availableCNA
MicrosoftMicrosoft Teams for Desktop1.0.0 to before 25122.1415.3698.681225122.1415.3698.6812Patch availableCNA
MicrosoftMicrosoft Teams for iOS2.0.0 to before 7.10.1 (100772025102901)7.10.1 (100772025102901)Patch availableCNA
MicrosoftMicrosoft Teams for Mac, New Edition1.0.0.0 to before 25122.1207.3700.144425122.1207.3700.1444Patch availableCNA
MicrosoftTeams for D365 Guides HoloLens907.0000 to before 907.2505.29001.0907.2505.29001.0Patch availableCNA
MicrosoftTeams for D365 Remote Assist HoloLens316.0000 to before 316.2505.28001316.2505.28001Patch availableCNA
MicrosoftTeams Panel1.0.97 to before 1449/1.0.97.20251022031449/1.0.97.2025102203Patch availableCNA
MicrosoftTeams Phone1.0.94 to before 1449/1.0.94.20251688021449/1.0.94.2025168802Patch availableCNA
  • Microsoft Teams for Android VendorMicrosoft Affected 1.0.0 to before 1416/1.0.0.2025102802 Fixed in 1416/1.0.0.2025102802 Patch available CNA
  • Microsoft Teams for Desktop VendorMicrosoft Affected 1.0.0 to before 25122.1415.3698.6812 Fixed in 25122.1415.3698.6812 Patch available CNA
  • Microsoft Teams for iOS VendorMicrosoft Affected 2.0.0 to before 7.10.1 (100772025102901) Fixed in 7.10.1 (100772025102901) Patch available CNA
  • Microsoft Teams for Mac, New Edition VendorMicrosoft Affected 1.0.0.0 to before 25122.1207.3700.1444 Fixed in 25122.1207.3700.1444 Patch available CNA
  • Teams for D365 Guides HoloLens VendorMicrosoft Affected 907.0000 to before 907.2505.29001.0 Fixed in 907.2505.29001.0 Patch available CNA
  • Teams for D365 Remote Assist HoloLens VendorMicrosoft Affected 316.0000 to before 316.2505.28001 Fixed in 316.2505.28001 Patch available CNA
  • Teams Panel VendorMicrosoft Affected 1.0.97 to before 1449/1.0.97.2025102203 Fixed in 1449/1.0.97.2025102203 Patch available CNA
  • Teams Phone VendorMicrosoft Affected 1.0.94 to before 1449/1.0.94.2025168802 Fixed in 1449/1.0.94.2025168802 Patch available CNA

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:dynamics_365_guides:*:*:*:*:*:hololens:*:*before 907.2505.29001.0VulnerableMicrosoft
cpe:2.3:a:microsoft:dynamics_365_remote_assist:*:*:*:*:*:hololens:*:*before 316.2505.28001VulnerableMicrosoft
cpe:2.3:a:microsoft:teams:*:*:*:*:*:android:*:*before 1.0.0.2025102802VulnerableMicrosoft
cpe:2.3:a:microsoft:teams:*:*:*:*:*:iphone_os:*:*before 7.10.1VulnerableMicrosoft
cpe:2.3:a:microsoft:teams:*:*:*:*:*:macos:*:*before 25122.1207.3700.1444VulnerableMicrosoft
cpe:2.3:a:microsoft:teams:*:*:*:*:desktop:*:*:*before 25122.1415.3698.6812VulnerableMicrosoft
cpe:2.3:a:microsoft:teams_panels:*:*:*:*:*:*:*:*before 1.0.97.2025102203VulnerableMicrosoft
cpe:2.3:a:microsoft:teams_phones:*:*:*:*:*:*:*:*before 1.0.94.2025168802VulnerableMicrosoft
  • cpe:2.3:a:microsoft:dynamics_365_guides:*:*:*:*:*:hololens:*:* Versions before 907.2505.29001.0 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:dynamics_365_remote_assist:*:*:*:*:*:hololens:*:* Versions before 316.2505.28001 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:teams:*:*:*:*:*:android:*:* Versions before 1.0.0.2025102802 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:teams:*:*:*:*:*:iphone_os:*:* Versions before 7.10.1 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:teams:*:*:*:*:*:macos:*:* Versions before 25122.1207.3700.1444 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:teams:*:*:*:*:desktop:*:*:* Versions before 25122.1415.3698.6812 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:teams_panels:*:*:*:*:*:*:*:* Versions before 1.0.97.2025102203 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:teams_phones:*:*:*:*:*:*:*:* Versions before 1.0.94.2025168802 Vulnerable ·Microsoft

Remediation

  • Fix · CNA Microsoft Teams for Android (Microsoft) Fixed in 1416/1.0.0.2025102802
  • Fix · CNA Microsoft Teams for Desktop (Microsoft) Fixed in 25122.1415.3698.6812
  • Fix · CNA Microsoft Teams for iOS (Microsoft) Fixed in 7.10.1 (100772025102901)
  • Fix · CNA Microsoft Teams for Mac, New Edition (Microsoft) Fixed in 25122.1207.3700.1444
  • Fix · CNA Teams for D365 Guides HoloLens (Microsoft) Fixed in 907.2505.29001.0
  • Fix · CNA Teams for D365 Remote Assist HoloLens (Microsoft) Fixed in 316.2505.28001
  • Fix · CNA Teams Panel (Microsoft) Fixed in 1449/1.0.97.2025102203
  • Fix · CNA Teams Phone (Microsoft) Fixed in 1449/1.0.94.2025168802

Vendor assessments

Microsoft

Microsoft's page for this CVE →

Impact
Remote Code Execution
Exploited
No
Publicly disclosed
No
Exploitability
Exploitation Less Likely
ProductStatusPlan or fix
Microsoft Teams for AndroidFixed 1416/1.0.0.2025102802 · Security Update
Microsoft Teams for DesktopFixed 25122.1415.3698.6812 · Security Update
Microsoft Teams for Mac, New EditionFixed 25122.1207.3700.1444 · Security Update
Microsoft Teams for iOSFixed 7.10.1 (100772025102901) · Security Update
Teams PanelsFixed 1449/1.0.97.2025102203 · Security Update
Teams PhonesFixed 1449/1.0.94.2025168802 · Security Update
Teams for D365 Guides HololensFixed 907.2505.29001.0 · Security Update
Teams for D365 Remote Assist HoloLensFixed 316.2505.28001 · Security Update

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-53783
  2. 2026-10-03 Alias added: GHSA-56v2-hh65-7486

References

Patch 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences