CVE-2026-78439 - Vulnerability Details - OpenCVE

Stack-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Microsoft	Office Office 365 Office Macos 2021 Office Macos 2024

No data.

No data.

References

Link	Providers
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-78439

History

Wed, 09 Sep 2026 22:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Tue, 08 Sep 2026 17:30:00 +0000

Type	Values Removed	Values Added
Description		Stack-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.
Title		Microsoft Office Graphics Component Remote Code Execution Vulnerability
First Time appeared		Microsoft Microsoft office Microsoft office 365 Microsoft office Macos 2021 Microsoft office Macos 2024
Weaknesses		CWE-121
CPEs		cpe:2.3:a:microsoft:office:::android:::::* cpe:2.3:a:microsoft:office_365::::::macos::* cpe:2.3:a:microsoft:office_macos_2021::::::long_term_servicing_channel::* cpe:2.3:a:microsoft:office_macos_2024::::::long_term_servicing_channel::*
Vendors & Products		Microsoft Microsoft office Microsoft office 365 Microsoft office Macos 2021 Microsoft office Macos 2024
References		https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-78439
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C'}`

MITRE

Status: PUBLISHED

Assigner: microsoft

Published: 2026-09-08T17:13:37.084Z

Updated: 2026-09-09T21:30:44.250Z

Reserved: 2026-08-24T16:21:50.285Z

Link: CVE-2026-78439

Vulnrichment

Updated: 2026-09-09T10:00:39.685Z

NVD

Status : Undergoing Analysis

Published: 2026-09-08T18:20:41.757

Modified: 2026-09-09T10:21:34.953

Link: CVE-2026-78439

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-78439", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "state": "PUBLISHED", "assignerShortName": "microsoft", "dateReserved": "2026-08-24T16:21:50.285Z", "datePublished": "2026-09-08T17:13:37.084Z", "dateUpdated": "2026-09-09T21:30:44.250Z"}, "containers": {"cna": {"title": "Microsoft Office Graphics Component Remote Code Execution Vulnerability", "datePublic": "2026-09-08T14:00:00.000Z", "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_macos_2021:*:*:*:*:*:long_term_servicing_channel:*:*", "versionStartIncluding": "-"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office:*:*:android:*:*:*:*:*", "versionStartIncluding": "16.0.1", "versionEndExcluding": "16.0.20430.20000"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_macos_2024:*:*:*:*:*:long_term_servicing_channel:*:*", "versionStartIncluding": "-"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_365:*:*:*:*:*:macos:*:*", "versionStartIncluding": "-"}]}]}], "affected": [{"vendor": "Microsoft", "product": "Microsoft Office 365 for Mac", "versions": [{"version": "-", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Office for Android", "versions": [{"version": "16.0.1", "lessThan": "16.0.20430.20000", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Office LTSC for Mac 2021", "versions": [{"version": "-", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Office LTSC for Mac 2024", "versions": [{"version": "-", "status": "affected"}]}], "descriptions": [{"value": "Stack-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "CWE-121: Stack-based Buffer Overflow", "lang": "en-US", "type": "CWE", "cweId": "CWE-121"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-09-09T21:30:44.250Z"}, "references": [{"name": "Microsoft Office Graphics Component Remote Code Execution Vulnerability", "tags": ["vendor-advisory", "patch"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-78439"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "HIGH", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-78439", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-09T04:21:14.775387Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-09T10:05:28.890Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-78439", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-09T04:21:14.775387Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-09T10:00:39.685Z"}}], "cna": {"title": "Microsoft Office Graphics Component Remote Code Execution Vulnerability", "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "Microsoft", "product": "Microsoft Office 365 for Mac", "versions": [{"status": "affected", "version": "-"}]}, {"vendor": "Microsoft", "product": "Microsoft Office for Android", "versions": [{"status": "affected", "version": "16.0.1", "lessThan": "16.0.20430.20000", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": "Microsoft Office LTSC for Mac 2021", "versions": [{"status": "affected", "version": "-"}]}, {"vendor": "Microsoft", "product": "Microsoft Office LTSC for Mac 2024", "versions": [{"status": "affected", "version": "-"}]}], "datePublic": "2026-09-08T14:00:00.000Z", "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-78439", "name": "Microsoft Office Graphics Component Remote Code Execution Vulnerability", "tags": ["vendor-advisory", "patch"]}], "descriptions": [{"lang": "en-US", "value": "Stack-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-121", "description": "CWE-121: Stack-based Buffer Overflow"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:office_macos_2021:*:*:*:*:*:long_term_servicing_channel:*:*", "vulnerable": true, "versionStartIncluding": "-"}, {"criteria": "cpe:2.3:a:microsoft:office:*:*:android:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "16.0.20430.20000", "versionStartIncluding": "16.0.1"}, {"criteria": "cpe:2.3:a:microsoft:office_macos_2024:*:*:*:*:*:long_term_servicing_channel:*:*", "vulnerable": true, "versionStartIncluding": "-"}, {"criteria": "cpe:2.3:a:microsoft:office_365:*:*:*:*:*:macos:*:*", "vulnerable": true, "versionStartIncluding": "-"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-09-09T21:30:44.250Z"}}}, "cveMetadata": {"cveId": "CVE-2026-78439", "state": "PUBLISHED", "dateUpdated": "2026-09-09T21:30:44.250Z", "dateReserved": "2026-08-24T16:21:50.285Z", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "datePublished": "2026-09-08T17:13:37.084Z", "assignerShortName": "microsoft"}, "dataVersion": "5.2"}