Heap-Based Buffer Overflow in Windows Graphics Component by Microsoft
CVE-2026-85908

7.8HIGH

Key Information:

Vendor

Microsoft
Status
Microsoft Office 365 For Mac
Microsoft Office For Android
Microsoft Office Ltsc For Mac 2021
Microsoft Office Ltsc For Mac 2024
Vendor
CVE Published:
13 October 2026

What is CVE-2026-85908?

A heap-based buffer overflow has been identified in the Windows Win32K graphics component, which can allow an authorized attacker to gain elevated privileges on the affected system. By exploiting this vulnerability, attackers can execute malicious operations that require elevated access, potentially leading to further compromise of system integrity. Users are encouraged to promptly apply available patches to mitigate this risk.

Affected Version(s)

Microsoft Office 365 for Mac 1.0.0 < 16.114.26101123

Microsoft Office for Android 16.0.1 < 16.0.20430.20000

Microsoft Office LTSC for Mac 2021 16.0.1 < 16.114.26101123

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisorypatch

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.