CVE-2026-78439 – Microsoft Office Graphics Component Remote Code Execution Vulnerability

CVE-2026-78439 is a critical stack-based buffer overflow (CWE-121) in the Microsoft Office Graphics Component. An unauthorized remote attacker can trigger the vulnerability by convincing a user to open a specially crafted file. Successful exploitation can execute code in the target context and can have a high impact on confidentiality, integrity, and availability.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: The vulnerability has a network attack vector, low attack complexity, and requires no attacker privileges. User interaction is required because the targeted user must open a specially crafted file. Successful exploitation could allow remote code execution with high confidentiality, integrity, and availability impact.

EXPLOITS: Microsoft assesses exploitation as less likely. The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is listed as unproven, so the existence of public exploit or proof-of-concept code cannot be confirmed.

TECHNICAL SUMMARY: CVE-2026-78439 is caused by a stack-based buffer overflow in the Microsoft Office Graphics Component. An attacker can prepare a specially crafted file and persuade a user to open it, triggering the vulnerable component. The attack uses a network attack vector with low complexity and requires no attacker privileges, although user interaction is necessary. Successful exploitation can result in remote code execution in the target context and compromise the confidentiality, integrity, and availability of the affected system.

EXPLOITABILITY: Affected products are Microsoft Office 365 for Mac, Microsoft Office for Android, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. Exploitation requires a user to open a specially crafted attacker-controlled file.

BUSINESS IMPACT: Successful exploitation could allow unauthorized code execution and lead to exposure or modification of sensitive information and disruption of affected systems. Organizations using the affected Office products face potentially significant security and operational consequences if users open malicious files.

WORKAROUND: No workaround or mitigation is specified. An official fix is identified as the remediation, so organizations unable to patch immediately have no confirmed workaround from the source information.

URGENCY: This vulnerability carries a Critical severity rating and a CVSS base score of 8.8. Its low attack complexity, lack of required attacker privileges, and potential for remote code execution make timely deployment important, even though exploitation is currently assessed as less likely and no active exploitation is identified.