Microsoft Patches Teams for Android Spoofing Flaw CVE-2026-32185

Microsoft disclosed and patched CVE-2026-32185, an Important spoofing vulnerability in Microsoft Teams for Android caused by improper access to files or directories, mapped to CWE-552. The flaw could allow an unauthorized local attacker to spoof trusted elements in the app and potentially trick users into accepting malicious content or communications. Microsoft assigned the issue a CVSS 3.1 score of 5.5 and said exploitation requires local access and user interaction, but could still have a high confidentiality impact.

Microsoft said the vulnerability was not publicly disclosed, not exploited in the wild, and had no public proof-of-concept at the time of publication, with exploitation assessed as less likely. The company released a fix through the Google Play Store and advised users to update Microsoft Teams for Android to version 1.0.0.2026092103 or later. Microsoft credited Ofek Levin of Enclave with responsibly reporting the issue.