Teams and Photos updates contain Security Vulnerabilities.

Question

Teams and Photos updates contain Security Vulnerabilities.

AJ Edward 0

MS Teams, msix version contains sqllite.dll version 3.49.0 which is flagged by Nessus (plugin ID 240237)

This is also the case with Windows.Photos

1 answer

Your answer

Answer 1

Teddie-D 3,920 Microsoft External Staff Moderator

Hi @AJ Edward
Thank you for posting your question in the Microsoft Q&A forum.

I’m truly sorry for the inconvenience this issue has caused and understand how frustrating it can be when trusted applications are flagged during security scans.

To mitigate this, the recommended action is to upgrade to SQLite version 3.49.1 or later, which addresses the vulnerability. However, since MS Teams and Windows.Photos are packaged and maintained by Microsoft, direct updates to embedded components like sqlite.dll may not be feasible manually.
You can refer to SQLite 3.44.0 < 3.49.1 Multiple Vulnerabilities | Tenable®
Note: Microsoft is providing this information as a convenience to you. The sites are not controlled by Microsoft. Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or information found there. Please make sure that you completely understand the risk before retrieving any suggestions from the above link.
Please keep an eye on Version update history for Teams app deployments - Office release notes | Microsoft Learn to track Microsoft’s release notes and security bulletins for updates to Teams and Windows.Photos that may include patched versions of sqlite.dll.
If possible, please consider isolating affected apps using application control or sandboxing to reduce risk while awaiting an official fix.
Thank you for your patience and understanding.

AJ Edward 0 Reputation points

2025-07-10T10:32:38.8166667+00:00

Your answer does not provide whether or not you will report the issue to the proper team or channel for resolution.
AJ Edward 0 Reputation points

2025-07-10T10:33:06.2066667+00:00

Your answer does not provide whether or not you will report the issue to the proper team or channel for resolution.
Teddie-D 3,920 Reputation points Microsoft External Staff Moderator

2025-07-11T11:01:35.8966667+00:00

Hi @AJ Edward
Thank you for your response.
We've received your report and will be forwarding it to our backend team for further review.

To ensure your feedback reaches the most relevant team, we also encourage you to share your experience on our Ideas · Community platform, where our product teams actively engage with users and gather insights that influence future improvements.

Your input is genuinely appreciated and plays an important role in shaping the evolution of our products and services.

Thank you for your understanding.
Teddie-D 3,920 Reputation points Microsoft External Staff Moderator

2025-07-14T06:41:33.0566667+00:00

Hi @AJ Edward
May I know if you have got any chance to check my answer? If you need further assistance, feel free to let me know.
If you found my response partially helpful, please consider marking it as an answer. It can help other community users in future to solve similar issues.
Thanks for your understanding.
AJ Edward 0 Reputation points

2025-07-24T11:21:28.73+00:00

The most current release, (25185.410.3812.8024) 21-JUL-2025, while this contains a newer version of the sqlite3.dll component, this is STILL VULNERABLE. The packed version is 3.49.0, the fixed version is 3.49.1. This needs rectification.
AJ Edward 0 Reputation points

2025-07-24T11:22:54.1533333+00:00

Note, my most recent comment, MS Photos is still vulnerable as well. Both applications need to be updated.
AJ Edward 0 Reputation points

2025-07-28T15:40:10.0466667+00:00

Teddie-D, please follow up. The newest version is still vulnerable to sqlite issues. they need to update to 3.49.1. I have thousands of computers on my enterprise that are affected. This goes for Photos also.

25185.410.3812.8024

25185.410.3812.8024
Teddie-D 3,920 Reputation points Microsoft External Staff Moderator

2025-07-29T07:51:22.2433333+00:00

Hi @AJ Edward

Thank you for your update, and my apologies for the delayed response.

We sincerely appreciate your ongoing efforts and close attention to this matter. I'm sorry to hear that the latest Teams update still includes the vulnerable sqlite.dll version and does not resolve the concern you've raised. I understand how critical this is, especially given its impact across your enterprise environment.

As a moderator, my testing environment is limited, and I don't have access to the backend tools needed to validate or deploy fixes. While you may have already submitted feedback through our Feedback Portal, I strongly recommend raising a support request via the Microsoft 365 admin center. Our backend support team has specialized tools and resources to investigate and address such issues more efficiently.

We truly appreciate your persistence and patience. Your input plays a vital role in helping us improve the security and reliability of our products.
AJ Edward 0 Reputation points

2025-07-29T16:38:34.7833333+00:00

I cannot reach this portal.
Teddie-D 3,920 Reputation points Microsoft External Staff Moderator

2025-07-30T02:06:17.7366667+00:00

Hi @AJ Edward
Since you don’t have the necessary permissions to access the Microsoft 365 admin center, please reach out to your IT team and ask them to submit a support request there.
Thank you for your understanding.
AJ Edward 0 Reputation points

2025-08-04T15:11:44.65+00:00

I am that person... I feel like there is not help here.
Teddie-D 3,920 Reputation points Microsoft External Staff Moderator

2025-08-05T02:12:40.8433333+00:00

Hi @AJ Edward
I'm truly sorry for the inconvenience you're experiencing. Unfortunately, at this time, there’s nothing further I can do from my side to assist directly.
As moderators, we’re unable to suggest specific solutions or workarounds, but please ensure that your IT team, with Global Administrator privileges, is actively collaborating with Microsoft’s backend specialists to identify the most effective resolution.
We sincerely appreciate your patience and understanding.
Juliao, Crishayr 5 Reputation points

2025-08-07T18:44:10.8933333+00:00

Hi @Teddie-D ,

I have the same issue as AJ, and it's effecting our security posture, we have tried upgrading teams to the latest version but still the SQLLITE.DLL which is embedded in teams is still 49.0.0 which is vul.

Even if you manually upgrade the SQLLITE it will reappear as soon as teams received update, this behavior it's the same with the curls.

Please advise.
AJ Edward 0 Reputation points

2025-08-20T10:14:29.31+00:00

MICROSOFT. THE ISSUE STILL EXISTS 3 UPDATES LATER!!!!!
Juliao, Crishayr 5 Reputation points

2025-08-20T11:51:25.8966667+00:00

Yeah, i know it's frustrating, but i have open up a case with them and they have told me the following: """"The issue will get rolled out by this to Aug-A train. If approved, the fix will reach general ring by the week of Aug 21st. If its not approved, then it will come in Aug-C train which reaches general ring around 1st week of September."""""
Teddie-D 3,920 Reputation points Microsoft External Staff Moderator

2025-08-21T03:34:26.03+00:00

Hi @AJ Edward @Juliao, Crishayr
Thank you for your updates.
We understand this issue may affect your workflow and raise concerns about security. Please remain patient and await the upcoming updates.
Your patience and understanding during this time are sincerely appreciated.
AJ Edward 0 Reputation points

2025-08-28T11:53:23.4933333+00:00

Teams has finally fixed the issue, however, BingWeather, Photos and Office Launchpad STILL have an even OLDER version of sqlite (3.46) please tell them to update ALL APPLICATIONS. This is becoming urgent at my federal organization.
Teddie-D 3,920 Reputation points Microsoft External Staff Moderator

2025-08-29T01:48:28.56+00:00

Hi @AJ Edward
Appreciate your update and response. I am glad to hear that the problem has been fixed. To avoid delays in support, please reach out to your Global Admin and submit a support request through the Microsoft 365 Admin Center for all related issues.
Thank you again for your understanding and cooperation.

Share via

Teams and Photos updates contain Security Vulnerabilities.

1 answer

Your answer