PT-2024-6145 · Microsoft · Teams

Francesco Benvenuto

·

Published

2024-06-07

·

Updated

2025-08-26

·

CVE-2024-41145

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Microsoft Teams (work or school) version 24046.2813.2770.1094 for macOS
Description A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams for macOS. This issue allows a specially crafted library to leverage Teams's access privileges, leading to a permission bypass. A malicious application could inject a library and start the program to trigger this vulnerability, then make use of the vulnerable application's permissions. The vulnerability is related to incorrect cryptographic signature verification, which can be exploited by a specially crafted library to bypass existing security restrictions.
Recommendations For Microsoft Teams (work or school) version 24046.2813.2770.1094, consider disabling the WebView.app helper app as a temporary workaround until a patch is available. Restrict access to the vulnerable application to minimize the risk of exploitation. Avoid using the vulnerable version of Microsoft Teams until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

BDU:2024-07064
CVE-2024-41145

Affected Products

Teams