Microsoft Teams for Android Flaw Exposes Heap Memory to Authenticated Attackers

Microsoft disclosed CVE-2026-42835, an Important-severity information disclosure vulnerability in Microsoft Teams for Android that could allow a remote, authenticated low-privileged attacker to access small portions of heap memory without user interaction. The flaw, classified as CWE-74 for improper neutralization of special elements in output used by a downstream component, carries a CVSS 3.1 score of 8.1 and may expose sensitive runtime data including authentication tokens, session information, or cached credentials.

Microsoft said the vulnerability was responsibly reported by Ofek Levin of Enclave through its coordinated disclosure program and has released a security update through the Google Play Store. The company stated that exploitation is considered less likely and that it had seen no public disclosure or evidence of active exploitation at the time of publication, but organizations using Teams for sensitive internal communications were urged to update affected Android clients promptly.