CVE-2026-42835: Microsoft Teams for Android Information Disclosure Vulnerability

Synopsis

An injection vulnerability in Microsoft Teams for Android allows an authenticated attacker to trigger information disclosure and cause service disruption over the network. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates the attack is reachable over the network, requires only a low-privilege account, and needs no victim interaction. Successful exploitation reads sensitive data exposed by the app and crashes or disrupts the Teams service for affected users. A patched-image rebuild at version 1.0.76.2026111302 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the vulnerable Teams for Android service over the network; the CVSS vector specifies AV:N, meaning no local or physical access is needed but the service must be network-exposed.

• AuthenticationRequired

  A valid account is needed to exploit this vulnerability, but any low-privilege user account is sufficient; CVSS PR:L means no administrative rights are required.

• Victim interactionNot required

  The attacker does not need to trick or involve any other user; the exploit can be executed entirely by the attacker without social engineering or user action (UI:N).

• Attack complexityDetail

  Exploitation is reliable and condition-free; CVSS AC:L indicates no race conditions, special memory layout, or environmental prerequisites are required to land the attack.

Blast Radius

• Reads sensitive information exposed by the Teams for Android app, which may include messages, session tokens, or user data transiting the affected component (C:H).
• Crashes or severely degrades the Teams for Android service for affected users, interrupting availability of the application (A:H).
• No data modification or write access is granted by this vulnerability; integrity of stored data is not directly affected (I:N).
• The scope is contained to the vulnerable application instance; lateral movement or host-level compromise is not indicated by this vulnerability alone (S:U).