What is the CVSS score of CVE-2026-42831?

CVE-2026-42831 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Microsoft Office are affected by CVE-2026-42831?

A vulnerability in Microsoft Office for Mac (LTSC 2021/2024) and Android could enable unauthorized access to sensitive data and device compromise if users open malicious files.. A patch is available.

How to fix or mitigate CVE-2026-42831?

Within 24 hours, inventory all deployed instances of Microsoft Office LTSC for Mac 2021/2024 and Office for Android using existing asset management and mobile device management systems to quantify exposure across the organization. Within 7 days, apply the available vendor patch to all affected systems, prioritizing endpoints for users in high-risk roles (finance, legal, executive) and targeting 90% coverage before full rollout; coordinate with device management teams to enable automatic updates where supported. Within 30 days, achieve 100% patch coverage across all managed and BYOD devices, confirm remediation status in asset management systems, and implement alerting for future Microsoft Office security updates to accelerate response cycles.

Microsoft Office CVE-2026-42831

EUVD-2026-29711 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-05-12 microsoft

GHSA-vvc2-cg8v-mmjx

Buffer Overflow Microsoft Heap Overflow Microsoft Office For Android Microsoft Office Ltsc For Mac 2021 Microsoft Office Ltsc For Mac 2024

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

vuln.today AI

7.8 HIGH

File must be opened locally by the user, so AV:L and UI:R; no privileges needed (PR:N) and memory corruption grants full C/I/A in the user context.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 21:35 vuln.today

CVE Published

May 12, 2026 - 16:59 nvd

HIGH 7.8

DescriptionCVE.org

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

Articles & Coverage 1

blog.talosintelligence.com Microsoft May 2026 Patch Tuesday: 31 Critical RCE Vulnerabilities Including Windows, Office, Azure May 12, 2026

AnalysisAI

Local code execution in Microsoft Office (LTSC for Mac 2021/2024 and Office for Android) via a heap-based buffer overflow (CWE-122) that an unauthorized attacker triggers when a victim opens a maliciously crafted document, yielding full confidentiality, integrity, and availability impact in the user's context. Exploitation requires user interaction (UI:R) and local access (AV:L), so weaponization depends on social engineering rather than remote reachability. This is no public exploit identified at time of analysis, with a very low EPSS score of 0.06% and CISA SSVC rating exploitation as 'none', indicating no observed activity despite the 'total' technical impact.

Technical ContextAI

The flaw is a CWE-122 heap-based buffer overflow, a memory-corruption class in which attacker-controlled input written to a heap allocation exceeds the buffer boundary, overwriting adjacent heap metadata or object data and enabling control-flow hijack or arbitrary code execution. The affected component is Microsoft Office's document/file parsing logic, reachable when Office renders a specially crafted file. Per the CPE data the vulnerable code ships in cpe:2.3:a:microsoft:microsoft_office_for_android, microsoft_office_ltsc_for_mac_2021, and microsoft_office_ltsc_for_mac_2024, meaning this is cross-platform (Android and macOS) rather than a Windows-only issue, consistent with shared cross-platform Office parsing code.

RemediationAI

Vendor-released patch: update to the fixed builds listed by Microsoft - Office LTSC for Mac 2021 and 2024 to 16.109.26051019 or later, and Office for Android to 16.0.19822.20190 or later - per the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42831. Because exploitation requires a user to open a crafted file, effective compensating controls where patching lags include enforcing Protected View / blocking documents originating from the internet or email, disabling automatic content and macro/active-content rendering, and user awareness training to avoid opening untrusted Office files; the trade-off is reduced convenience and possible workflow friction when legitimately handling external documents. Also consider mail-gateway and EDR file-attachment scanning to reduce delivery of malicious documents.