CVE-2026-81955: CWE-122: Heap-based Buffer Overflow in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-81955) involves a heap-based buffer overflow in the Microsoft Graphics Component within Microsoft 365 Apps for Enterprise. An attacker can exploit this flaw remotely without privileges and with low attack complexity, requiring user interaction. Successful exploitation could lead to full confidentiality, integrity, and availability impact, including remote code execution. The vulnerability affects multiple versions of Microsoft 365 Apps for Enterprise and related components. Microsoft has published an official fix and manages remediation for this cloud-hosted service.

The vulnerability allows an unauthorized attacker to remotely execute code on affected systems, potentially leading to full compromise of confidentiality, integrity, and availability. This could enable attackers to run arbitrary code with the privileges of the targeted application, causing significant security impact.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft as detailed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81955. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Check the vendor advisory for the latest update status and guidance.