CVE-2025-32711: AI command injection in Microsoft 365 Copilot

What happened

• According to GitHub Advisory Database's advisory (June 11, 2025), AI command injection in M365 Copilot allowed an unauthorized attacker to disclose information over a network. [1][2]

Impact

• Rated critical (CVSS 9.3) in the GitHub Advisory Database; the vector requires no privileges and no user interaction. [1]

What was done

• Microsoft lists the CVE in its Security Update Guide, linked from NVD and the GitHub advisory. [2][1]

How to protect yourself

• Follow Microsoft's guidance for CVE-2025-32711 in the Security Update Guide. [3]

Sources

1. GHSA-h2w9-p5qf-qmrh — GitHub Advisory Database
2. CVE-2025-32711 — NVD
3. CVE-2025-32711 — Microsoft Security Response Center

Every statement above was checked against these sources before publishing. Spotted an error? Tell us and we will correct it with a dated note.