CVE-2026-85881: CWE-121: Stack-based Buffer Overflow in Microsoft Microsoft Office for Android

CVE-2026-85881 is a stack-based buffer overflow vulnerability (CWE-121) found in the Microsoft Graphics Component used by Microsoft Office for Android. An attacker with authorized access can exploit this vulnerability remotely over a network to elevate their privileges. The vulnerability affects Microsoft Office for Android versions from 16.0.1 up to but not including 16.0.20430.20000. Microsoft has released an official fix to address this issue.

Successful exploitation of this vulnerability could allow an authorized attacker to gain elevated privileges on the affected system, potentially leading to full compromise of the Microsoft Office for Android application and associated data. The CVSS v3.1 base score is 8.0 (high), indicating a significant impact on confidentiality, integrity, and availability.

An official fix is available from Microsoft. Users and administrators should apply the security update for Microsoft Office for Android to versions 16.0.20430.20000 or later as provided in the Microsoft Security Response Center advisory. No additional mitigation steps are indicated beyond applying the official patch.