CVE-2025-49737 - Vulnerability Details - OpenCVE

Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Teams allows an authorized attacker to elevate privileges locally.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Microsoft	Teams Teams For Mac

No data.

No data.

References

Link	Providers
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49737

History

Wed, 23 Jul 2025 17:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Microsoft Microsoft teams Microsoft teams For Mac
Vendors & Products		Microsoft Microsoft teams Microsoft teams For Mac

Wed, 16 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00041}`	epss `{'score': 0.0003}`

Mon, 14 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00036}`	epss `{'score': 0.00041}`

Fri, 11 Jul 2025 14:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Tue, 08 Jul 2025 17:15:00 +0000

Type	Values Removed	Values Added
Description		Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Teams allows an authorized attacker to elevate privileges locally.
Title		Microsoft Teams Elevation of Privilege Vulnerability
Weaknesses		CWE-362
References		https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49737
Metrics		cvssV3_1 `{'score': 7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C'}`

MITRE

Status: PUBLISHED

Assigner: microsoft

Published: 2025-07-08T16:58:14.537Z

Updated: 2025-08-05T18:12:50.655Z

Reserved: 2025-06-09T22:49:37.617Z

Link: CVE-2025-49737

Vulnrichment

Updated: 2025-07-11T13:24:22.041Z

NVD

Status : Awaiting Analysis

Published: 2025-07-08T17:16:02.460

Modified: 2025-07-10T13:18:53.830

Link: CVE-2025-49737

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-49737", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "state": "PUBLISHED", "assignerShortName": "microsoft", "dateReserved": "2025-06-09T22:49:37.617Z", "datePublished": "2025-07-08T16:58:14.537Z", "dateUpdated": "2025-08-05T18:12:50.655Z"}, "containers": {"cna": {"title": "Microsoft Teams Elevation of Privilege Vulnerability", "datePublic": "2025-07-08T07:00:00.000Z", "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:teams:*:*:*:*:*:mac:*:*", "versionStartIncluding": "1.0.0.0", "versionEndExcluding": "25163.3001.3726.6503"}]}]}], "affected": [{"vendor": "Microsoft", "product": "Microsoft Teams for Mac", "platforms": ["Unknown"], "versions": [{"version": "1.0.0.0", "lessThan": "25163.3001.3726.6503", "versionType": "custom", "status": "affected"}]}], "descriptions": [{"value": "Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Teams allows an authorized attacker to elevate privileges locally.", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')", "lang": "en-US", "type": "CWE", "cweId": "CWE-362"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2025-08-05T18:12:50.655Z"}, "references": [{"name": "Microsoft Teams Elevation of Privilege Vulnerability", "tags": ["vendor-advisory"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49737"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "HIGH", "baseScore": 7, "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-49737", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-07-09T04:01:25.440186Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-11T13:30:28.620Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-49737", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-07-09T04:01:25.440186Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-11T13:24:22.041Z"}}], "cna": {"title": "Microsoft Teams Elevation of Privilege Vulnerability", "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 7, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "Microsoft", "product": "Microsoft Teams for Mac", "versions": [{"status": "affected", "version": "1.0.0.0", "lessThan": "25163.3001.3726.6503", "versionType": "custom"}], "platforms": ["Unknown"]}], "datePublic": "2025-07-08T07:00:00.000Z", "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49737", "name": "Microsoft Teams Elevation of Privilege Vulnerability", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en-US", "value": "Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Teams allows an authorized attacker to elevate privileges locally."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-362", "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:teams:*:*:*:*:*:mac:*:*", "vulnerable": true, "versionEndExcluding": "25163.3001.3726.6503", "versionStartIncluding": "1.0.0.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2025-08-05T18:12:50.655Z"}}}, "cveMetadata": {"cveId": "CVE-2025-49737", "state": "PUBLISHED", "dateUpdated": "2025-08-05T18:12:50.655Z", "dateReserved": "2025-06-09T22:49:37.617Z", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "datePublished": "2025-07-08T16:58:14.537Z", "assignerShortName": "microsoft"}, "dataVersion": "5.1"}