---
id: "CVE-2026-122979"
page: "https://infrastack.ai/live/CVE-2026-122979"
kind: "vulnerability"
aliases: ["CVE-2026-122979"]
title: "Microsoft Teams for Android: code injection lets an attacker spoof over network"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["android", "microsoft-teams", "mobile", "other", "user-interaction"]
not_affected_if: []
published_at: "2026-11-10T19:20:37+00:00"
first_seen_at: "2026-11-10T19:25:11+00:00"
updated_at: "2026-11-10T21:37:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-122979", "first_seen_at": "2026-11-10T19:25:11+00:00"}, {"source": "analyst", "url": "https://radar.offseq.com/threat/cve-2026-122979-cwe-94-code-injection-in-microsoft-microsoft-teams-for-android-71dd9108ee567b27", "first_seen_at": "2026-11-10T21:37:33+00:00", "cites": ["https://radar.offseq.com/threat/cve-2026-122979-cwe-94-code-injection-in-microsoft-microsoft-teams-for-android-71dd9108ee567b27"]}]
exploit_sources: []
---

# Microsoft Teams for Android: code injection lets an attacker spoof over network

Link for people: https://infrastack.ai/live/CVE-2026-122979 (this .md is for agents)

Microsoft Teams for Android has a code injection flaw (CWE-94) that lets an unauthenticated attacker spoof over a network. Microsoft's CVSS 3.1 vector (as relayed by OffSeq, 8.1 High) is network, low complexity, no privileges, user interaction required, high confidentiality and integrity impact. No exploitation or public PoC is reported. The fixed build and affected range could not be read: the MSRC page did not render for our tools.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Open Teams on Android (Play Store > Manage apps, or Settings > Apps > Teams) and note the version. Compare with the fixed build on the MSRC page for CVE-2026-122979 (msrc.microsoft.com/update-guide/vulnerability/CVE-2026-122979), which we could not read. Until then, update Teams from Google Play to the latest version. Managed Teams Android devices update through Teams Admin Center.

## Timeline

- 2026-11-10T19:25:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-122979
- 2026-11-10T21:37:33+00:00 analyst https://radar.offseq.com/threat/cve-2026-122979-cwe-94-code-injection-in-microsoft-microsoft-teams-for-android-71dd9108ee567b27 — MSRC page unreadable (JS-only; web-cli and WebFetch returned nothing); only secondary OffSeq page read, which says an official fix exists but lists no fixed version. Nothing verified. Settle by reading MSRC page via browser-cli or CSAF. X not checked (not worth cost for a fresh CVE).

## Documents

- [describes] OffSeq: CVE-2026-122979 Microsoft Teams for Android https://radar.offseq.com/threat/cve-2026-122979-cwe-94-code-injection-in-microsoft-microsoft-teams-for-android-71dd9108ee567b27

## From the sources

Improper control of generation of code ('code injection') in Microsoft Teams for Android allows an unauthorized attacker to perform spoofing over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_