Privacy Trust

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2025) for more information. 

Added an acknowledgement. This is an informational change only. 

Updated acknowledgment. This is an informational change only. 

Ai command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network. 

Acknowledgement added. This is an informational change only. 

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. 

Missing release of memory after effective lifetime in Windows Cryptographic Services allows an unauthorized attacker to execute code over a network. 

Untrusted search path in .NET and Visual Studio allows an unauthorized attacker to execute code over a network. 

Use after free in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network. 

Use after free in Windows Win32K – GRFX allows an authorized attacker to elevate privileges locally.