CVE-2026-78439: CWE-121: Stack-based Buffer Overflow in Microsoft Microsoft Office 365 for Mac

CVE-2026-78439 is a stack-based buffer overflow vulnerability identified in the Microsoft Graphics Component within Microsoft Office 365 for Mac. The flaw enables remote code execution by an unauthorized attacker over a network. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high severity with high impact on confidentiality, integrity, and availability. Affected versions include multiple version ranges prior to fixed builds, specifically versions >=1.0.0 and <16.113.26091433, >=16.0.1 and <16.0.20430.20000, and others as detailed. Microsoft has issued an official fix and manages remediation for this cloud service. No public exploit code or active exploitation has been reported.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code remotely on affected systems, potentially leading to full compromise of confidentiality, integrity, and availability of the affected environment. Given the high CVSS score and the nature of the flaw (stack-based buffer overflow), the impact is considered high.

An official fix is available from Microsoft. Users and administrators should apply the latest updates for Microsoft Office 365 for Mac as provided by Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-78439 for detailed patch and update instructions.