Microsoft Office Android CVE-2026-105731

Exploitation requires the attacker to already possess local, low-privileged authorized access to a device running Microsoft Office for Android version 16.0.1 prior to 16.0.20430.20000 (per EUVD affected-version data); no user interaction is needed (UI:N). The vulnerability is in the graphics component's handling of an uninitialized resource and yields confidentiality impact only. Limiting factors: no remote vector (AV:L - cannot be triggered over a network), prior authentication/local presence is mandatory (PR:L), and the affected scope appears confined to a specific vulnerable Android Office build range, so patched or non-Android installations are not exposed.

This is a moderate-severity, low-priority issue in practice. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) describes a locally-exploitable information disclosure requiring the attacker to already have low-level authorized access to the device; there is no integrity or availability impact and no scope change. The confidentiality impact is rated High (CWE-908, use of uninitialized resource - i.e. leakage of residual uninitialized memory contents), which is what drives the score above medium. No EPSS score, SSVC decision data, KEV listing, or public POC was provided in the input, so there is no signal of active or probable exploitation; absence of these is not itself evidence of safety but does argue against urgency. The signals are internally consistent - a local, authenticated, memory-disclosure bug is a classic low-weaponization finding, typically chained as a secondary primitive (e.g., defeating ASLR or leaking tokens) rather than used standalone. One cross-reference caveat: the Description attributes this to the 'Microsoft Graphics Component' generically, while the EUVD affected-product data scopes it specifically to Microsoft Office for Android - verify the true affected surface with Microsoft's advisory before concluding which platforms are impacted.

A low-privileged but authorized user (or malicious app) on an Android device running a vulnerable Microsoft Office build triggers the graphics component to process content, causing it to return uninitialized memory. The leaked bytes may contain residual sensitive data from other operations, which the attacker reads to gather information. No public exploit code was identified, and exploitation requires local access with existing low privileges (AV:L/PR:L).