CVE-2026-41102

CVSS: 5.5 Medium
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Risk score: 44.0
Published: 2026-05-12
Status: Analyzed

Improper access control in Microsoft Office PowerPoint allows an authorized attacker to perform spoofing locally.

Weaknesses

CWE-284

Coverage 2

threat-intel

Coding Gaffe Exposes Microsoft 365 Accounts to Widespread Takeover

A coding error in several Microsoft 365 Android applications, specifically Excel, Word, PowerPoint, OneNote, Loop, and Microsoft 365 Copilot, exposed user accounts to potential compromise. The issue stemmed from a disabl…

Dark Reading · Jun 3, 2026 High

CVE-2026-41100 CVE-2026-41101 CVE-2026-41102 authentication tokens android

vulnerability

Microsoft 365 Android Apps Let Any App Steal Account Tokens via Leftover Debug Flag

A vulnerability in Microsoft 365 Android apps allowed unauthorized apps to steal user account tokens, potentially granting access to sensitive data like emails and calendar information. The flaw, discovered by Enclave, s…

The Hacker News · Jun 3, 2026 High

CVE-2026-41100 CVE-2026-41101 CVE-2026-41102 android token spoofing

All articles mentioning it

Advisories and references

msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41102