CVE-2026-42835

HighCVSS 8.1

Published: 09/06/2026(UTC)Updated: 23/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.26%

67th percentile - higher than 67% of all known CVEs

Summary

Improper neutralization of special elements in output used by a downstream component ('injection') in Microsoft Teams for Android allows an authorized attacker to disclose information over a network.

Risk Assessment

An authorized attacker can exploit this vulnerability to disclose sensitive information over a network.

Recommendation

Apply the update provided by Microsoft for Microsoft Teams on Android.

Other vulnerabilities in Microsoft Teams for Android

See all

CVE-2026-65768High
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Teams for Android allows an unauthorized attacker to execute code over a network.
CVE-2026-65767High
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Teams for Android allows an authorized attacker to perform spoofing over a network.

Original NVD description (English source)

Improper neutralization of special elements in output used by a downstream component ('injection') in Microsoft Teams for Android allows an authorized attacker to disclose information over a network.