by Kastro
Paper/Archive/CVE-2024-41138

CVE-2024-41138

Microsoft Teams (work or school) — A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work or school) 24046.…

EPSS 0.9%CVSS 9.8
critical.is priorityof 100
41
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 59.9.599 × 2012.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. A specially crafted library can leverage Teams's access privileges, leading to a permission bypass. A malicious application could inject a library and start the program to trigger this vulnerability and then make use of the vulnerable application's permissions.

Affected

ProductAffectedFixed inSource
Teams (work or school)24046.2812.2722.8193 for macOS–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
talos (CNA)7.1CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

reftalosintelligence.com/vulnerability_reports/TALOS-2024-1991reftalosintelligence.com/vulnerability_reports/TALOS-2024-1991