Vulnerability · Published Dec 18, 2024 · Assigned by talos
CVE-2024-41138
High 7.1
In plain English
A high-severity security flaw in Teams (work or school) from Microsoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities).
Official description
A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. A specially crafted library can leverage Teams's access privileges, leading to a permission bypass. A malicious application could inject a library and start the program to trigger this vulnerability and then make use of the vulnerable application's permissions.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Teams (work or school) | 24046.2812.2722.8193 for macOS |
Weakness: CWE-347 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N