Inquiry: CVE-2026-10536 (libcurl) flagged in MS Teams, Copilot, and Office Hub - Is the vulnerable code path reachable?

Our vulnerability management tool (Tanium) has recently flagged CVE-2026-10536 across multiple endpoints in our environment. The detection is being triggered strictly by the presence of a vulnerable libcurl.dll version that is bundled within several Microsoft application packages.

Here are the specific paths being flagged by our scanners:

• C:\Program Files (x86)\Microsoft\Copilot\Application\undocked_copilot\libcurl.dll

C:\Program Files\WindowsApps\MSTeams_26134.1702.4747.7366_x64__8wekyb3d8bbwe\libcurl.dll

C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_19.2610.35011.0_x64__8wekyb3d8bbwe\libcurl.dll

Based on the CVE documentation, this Use-After-Free (UAF) vulnerability requires a highly specific sequence to be exploited: the application must actively use HTTP/2 stream dependency features (CURLOPT_STREAM_DEPENDS or CURLOPT_STREAM_DEPENDS_E) and subsequently invoke curl_easy_reset().

Since SCA (Software Composition Analysis) scanners flag the DLL based solely on its version string without evaluating the application's actual runtime behavior, we are trying to assess the true risk for our environment.

My questions for the product teams are:

Do MS Teams, Copilot, and the Office Hub actually utilize these specific HTTP/2 stream dependency features, or is the vulnerable code path unreachable in the context of these applications?

Is there an expected timeline/roadmap for when the libcurl.dll component will be updated to a patched version in these specific app packages via the Microsoft Store or standard update channels?

Any official insight or clarification would be greatly appreciated to help us properly document this for our internal risk assessment and exception handling (if it qualifies as a contextual False Positive).

Thank you in advance!Our vulnerability management tool (Tanium) has recently flagged CVE-2026-10536 across multiple endpoints in our environment. The detection is being triggered strictly by the presence of a vulnerable libcurl.dll version that is bundled within several Microsoft application packages.

Here are the specific paths being flagged by our scanners:

C:\Program Files (x86)\Microsoft\Copilot\Application\undocked_copilot\libcurl.dll

C:\Program Files\WindowsApps\MSTeams_26134.1702.4747.7366_x64__8wekyb3d8bbwe\libcurl.dll

C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_19.2610.35011.0_x64__8wekyb3d8bbwe\libcurl.dll

Based on the CVE documentation, this Use-After-Free (UAF) vulnerability requires a highly specific sequence to be exploited: the application must actively use HTTP/2 stream dependency features (CURLOPT_STREAM_DEPENDS or CURLOPT_STREAM_DEPENDS_E) and subsequently invoke curl_easy_reset().

Since SCA (Software Composition Analysis) scanners flag the DLL based solely on its version string without evaluating the application's actual runtime behavior, we are trying to assess the true risk for our environment.

My questions for the product teams are:

Do MS Teams, Copilot, and the Office Hub actually utilize these specific HTTP/2 stream dependency features, or is the vulnerable code path unreachable in the context of these applications?

Is there an expected timeline/roadmap for when the libcurl.dll component will be updated to a patched version in these specific app packages via the Microsoft Store or standard update channels?

Any official insight or clarification would be greatly appreciated to help us properly document this for our internal risk assessment and exception handling (if it qualifies as a contextual False Positive).

Thank you in advance!