SB20261111116 - Code Injection in Microsoft Teams for Android

Description

This security bulletin contains information about 1 vulnerability.

1) Code Injection (CVE-ID: CVE-2026-122979)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: 8.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to obtain a Teams session token and impersonate the affected user within the token's permissions.

The vulnerability exists due to improper control of code generation in Microsoft Teams for Android when synchronizing a malicious agent. A remote attacker can persuade a user or administrator to install a malicious agent to obtain a Teams session token and act as the affected user within the token's permissions.

Remediation

Install update from vendor's website.

References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-122979
• https://play.google.com/store/apps/details?id=com.microsoft.teams