CVE-2026-81955 – Windows Graphics Component Remote Code Execution Vulnerability

CVE-2026-81955 is a critical heap-based buffer overflow vulnerability in the Microsoft Graphics Component. An unauthorized attacker can send a specially crafted RTF file and convince a user to open it in Microsoft Word and save it as a filtered web page. Successful exploitation can execute code in the user’s context. Authentication and prior privileges are not required, although user interaction is required. The Preview Pane is not an attack vector.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: The vulnerability has a network attack vector, low attack complexity, and requires no privileges. An attacker must convince a user to interact with a specially crafted RTF document. Successful exploitation can have a high impact on confidentiality, integrity, and availability by executing attacker-controlled code in the user’s context.

EXPLOITS: The exploitability assessment is Exploitation Unlikely. The vulnerability is not publicly disclosed and is not known to be exploited. Exploit Code Maturity is Unproven; no confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.

TECHNICAL SUMMARY: CVE-2026-81955 is caused by a heap-based buffer overflow (CWE-122) in the Microsoft Graphics Component. An attacker can craft an RTF file and persuade a user to open it in Microsoft Word and save it as a filtered web page. This processing can trigger the vulnerability and allow code execution in the user’s context. The attack does not require authentication or existing privileges, but user interaction is necessary. The CVSS metrics rate confidentiality, integrity, and availability impacts as High.

EXPLOITABILITY: Affected products include 32-bit and 64-bit editions of Microsoft 365 Apps for Enterprise, Microsoft Office 2016, Office 2019, Office LTSC 2021, and Office LTSC 2024. Exploitation requires a user to open a malicious RTF file in Microsoft Word and save it as a filtered web page.

BUSINESS IMPACT: Successful exploitation could allow attacker-controlled code to run with the affected user’s permissions, potentially exposing sensitive information, allowing unauthorized changes, and disrupting system availability. A convincing malicious document could turn normal document handling into a path for compromise.

WORKAROUND: No workaround or mitigation is identified. An official fix is listed as the remediation.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 8.8 and can result in remote code execution with high confidentiality, integrity, and availability impacts. Although exploitation is assessed as unlikely and no active exploitation is identified, organizations should prioritize deployment of the official fix because no workaround or mitigation is identified.