Summary
Ein Angreifer kann mehrere Schwachstellen in Microsoft Windows Terminal, 365 Copilot und Github Copilotausnutzen, um beliebigen Programmcode auszuführen, um falsche Informationen darzustellen und um seine Privilegien zu erhöhen.
Product
Microsoft Windows Terminal ist eine Terminalanwendung für Windows-Betriebssysteme, die mehrere Befehlszeilen-Schnittstellen in einem einzigen Fenster vereint.
Microsoft Copilot ist ein KI-Assistent, der in verschiedene Microsoft-Produkte integriert werden kann.
Vulnerabilities 8
-
Critical 9.6
Microsoft Edge Copilot Remote Code Execution Vulnerability
Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft PC Manager Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in Microsoft PC Manager allows an authorized attacker to elevate privileges locally.
-
High 8.1
Microsoft Bing App for IOS Spoofing Vulnerability
Improper restriction of rendered ui layers or frames in Microsoft Bing App for IOS allows an unauthorized attacker to perform spoofing over a network.
-
High 8.1
M365 Copilot for iOS Elevation of Privilege Vulnerability
Improper access control in Microsoft 365 Copilot for iOS allows an unauthorized attacker to elevate privileges over a network.
-
High 7.8
GitHub Copilot Remote Code Execution Vulnerability
Improper restriction of names for files and other resources in Github Copilot allows an unauthorized attacker to execute code locally.
-
High 7.8
Windows Terminal Remote Code Execution Vulnerability
Integer overflow or wraparound in Windows Terminal allows an unauthorized attacker to execute code locally.
-
High 7.8
Microsoft PC Manager Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in Window PC Manager allows an authorized attacker to elevate privileges locally.
-
Medium 6.3
Outlook Copilot Tampering Vulnerability
Improper neutralization of special elements used in a command ('command injection') in Outlook Copilot allows an authorized attacker to perform tampering over a network.
Revision history
-
#1
Initiale Fassung
References
-
Microsoft Leitfaden für Sicherheitsupdates
https://msrc.microsoft.com/update-guide/
-
Microsoft Security Advisory CVE-2026-54124
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54124
-
Microsoft Security Advisory CVE-2026-58595
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58595
-
Microsoft Security Advisory CVE-2026-50438
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50438
-
Microsoft Security Advisory CVE-2026-58636
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58636
-
Microsoft Security Advisory CVE-2026-41106
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41106
-
Microsoft Security Advisory CVE-2026-48561
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48561
-
Microsoft Security Advisory CVE-2026-58617
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58617