CVE-2025-53783
Microsoft Teams Remote Code Execution Vulnerability
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1416/1.0.0.2025102802, 25122.1415.3698.6812, 7.10.1 (100772025102901), 25122.1207.3700.1444, 907.2505.29001.0, and 3 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 1 proof of concept on GitHub
CISA's decision points: whether it is exploited, whether attacks can be automated, and how much control an attacker gets. Assessed (SSVC 2.0.3).What do these mean? →
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
Heap-based buffer overflow in Microsoft Teams allows an unauthorized attacker to execute code over a network.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- Microsoft Microsoft Teams for Android
From 1.0.0 · fixed in 1416/1.0.0.2025102802
- Microsoft Microsoft Teams for Desktop
From 1.0.0 · fixed in 25122.1415.3698.6812
- Microsoft Microsoft Teams for iOS
From 2.0.0 · fixed in 7.10.1 (100772025102901)
- Microsoft Microsoft Teams for Mac, New Edition
From 1.0.0.0 · fixed in 25122.1207.3700.1444
- Microsoft Teams for D365 Guides HoloLens
From 907.0000 · fixed in 907.2505.29001.0
- Microsoft Teams for D365 Remote Assist HoloLens
From 316.0000 · fixed in 316.2505.28001
- Microsoft Teams Panel
From 1.0.97 · fixed in 1449/1.0.97.2025102203
- Microsoft Teams Phone
From 1.0.94 · fixed in 1449/1.0.94.2025168802