CVE detail
CVE-2025-64671
Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to execute code locally.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 13.9 · diversity 8.0 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 0
- within the 30d window
- Peak daily
- 0
- highest bucket
Evidence
Source links by recency
3 source links · newest first
- December Patch Tuesday fixes three zero-days, including one that hijacks Windows devicesMalwarebytes Labs
The update patches three zero-days and introduces a new PowerShell warning meant to help you avoid accidentally running unsafe code from the web.
newswww.malwarebytes.comDec 10, 2025, 4:06 PM - Microsoft Patch Tuesday security updates for December 2025 fixed an actively exploited zero-daySecurity Affairs
Microsoft Patch Tuesday security updates for December 2025 address 57 vulnerabilities, including three critical flaws. Microsoft Patch Tuesday security updates for December 2025 addressed 57 vulnerabilities in Windows and Windows components, Office and Office Components, Microsoft Edge (Chromium-based), Exchange Server, Azure, Copilot, PowerShell, and Windows Defender. Three vulnerabilities are rated Critical, while the rest are […]
newssecurityaffairs.comDec 10, 2025, 8:47 AM Microsoft has addressed a Windows vulnerability exploited as zero-day that allows attackers to obtain System privileges.
newswww.securityweek.comDec 9, 2025, 8:29 PM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2026-21516CVSS 8.8 · High
Improper neutralization of special elements used in a command ('command injection') in Github Copilot allows an unauthorized attacker to execute code over a network.
- CVE-2026-7849CVSS 9.3 · Critical
Due to improper neutralization of special elements, an unauthenticated remote attacker is able to inject a command into the system configuration which is subsequently executed as…
- CVE-2026-54680CVSS 9.9 · Critical
Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/mod…
- CVE-2026-16763CVSS 1.9 · Low
A vulnerability was identified in localstack serverless-localstack up to 1.4.0. The affected element is an unknown function of the file src/index.js of the component Configuration…
- CVE-2024-58354CVSS 8.5 · High
cal.com (calcom repository, later renamed cal.diy) is affected by a repository takeover vulnerability in its GitHub Actions workflows. The workflow pr.yml uses the pull_request_ta…
- CVE-2026-47670CVSS 9.4 · Critical
DbGate is cross-platform database manager. Versions 7.1.8 and prior are vulnerable to authenticated Remote Code Execution (RCE). Any user with valid DbGate credentials can execute…