CVE-2024-42004

PoC ×2—1

CVSS 3.1

9.8 critical

EPSS

<1%p55

Published

Dec 18, 2024 (Dec 18, 2024)

Modified

Jun 17, 2026

Description

A library injection vulnerability exists in Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. A specially crafted library can leverage Teams's access privileges, leading to a permission bypass. A malicious application could inject a library and start the program to trigger this vulnerability and then make use of the vulnerable application's permissions.

Vendors: microsoft
Products: teams
Weakness: CWE-347
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.8%)

In the news4 stories

Vulnerabilities in Microsoft apps for macOS allow stealing permissions

Security AffairsSep 3, 13:04 UTC · Sep 3, 2024Vulnerability CVE-2024-42220 CVE-2024-42004 CVE-2024-39804+5 CVEs

Vulnerabilities in Microsoft macOS apps may give attackers access to microphone, camera

Help Net SecurityAug 20, 00:00 UTC · Aug 20, 2024Vulnerability CVE-2024-41138 CVE-2024-41145 CVE-2024-41159+5 CVEs

Microsoft Apps for macOS Exposed to Library Injection Attacks

Infosecurity MagazineAug 19, 15:15 UTC · Aug 19, 2024Vulnerability CVE-2024-42220 CVE-2024-42004 CVE-2024-39804+5 CVEs1

How multiple vulnerabilities in Microsoft apps for macOS pave the way to stealing permissions

Cisco TalosAug 19, 10:00 UTC · Aug 19, 2024Vulnerability CVE-2024-42220 CVE-2024-42004 CVE-2024-39804+5 CVEs