Microsoft Office for Android: Elevation of privilege via stack-based buffer overflow
Summary
Microsoft Office for Android contains a stack-based buffer overflow in the Microsoft Office Graphics component. An authorized attacker with a low-privileged foothold on the network can elevate privileges, with user interaction required. The vendor rates the impact on confidentiality, integrity and availability as high. The CPE entry 365 Copilot in the source data is not supported by the CVE record or the MSRC advisory and should be corrected.
Affected
- Microsoft Office for Android, builds 16.0.1 up to but not including 16.0.20430.20000 (per CVE record; vendor table not confirmed)
Fixed in
- Build 16.0.20430.20000 or later (inferred from the affected range; to be confirmed on the MSRC advisory)
Workaround
Unknown.
Exploitation
- No known exploitation (CISA SSVC: exploitation none, not automatable).
- No public proof-of-concept found.
- Not listed in CISA KEV.
Our recommendation
- Inventory all phones and tablets with Office for Android, including BYOD devices, via MDM reports.
- Update Office for Android through the app store to build 16.0.20430.20000 or later.
- Correct the product entry in the asset inventory from 365 Copilot to Office for Android.
- Re-check the MSRC advisory for the confirmed fixed build and any change in exploitation status.
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MSRC Security Update Guide: CVE-2026-85881 msrc.microsoft.com
- OpenCVE: CVE-2026-85881 app.opencve.io
- Strix: CVE-2026-85881 www.strix.ai
- Vulners NVD: CVE-2026-85881 vulners.com
- VulDB 419286 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:23.
Original description (NVD)
Stack-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.