Office for Android CVE-2026-85881

Exploitation requires the victim to open attacker-supplied content (a crafted document or graphics object) within Microsoft Office for Android, builds 16.0.1 up to but not including 16.0.20430.20000 - fixed builds are not affected. The CVSS vector's PR:L means the attacker needs a low-privileged/legitimate app context, and UI:R means the exploit cannot fire without the user actively opening or rendering the malicious file. These two factors - required user interaction and an existing low-privilege foothold, combined with the narrow platform (Android) and version window - are the principal limits on real-world exploitability and should temper the raw 8.0 score.

This is a credible mid-to-high priority issue but not a top-tier emergency based on current signals. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, base 8.0) indicates a network-reachable, low-complexity attack that nonetheless requires both low-level privileges (PR:L - an authenticated/legitimate app context) and user interaction (UI:R - the victim must act, typically open a crafted document). No EPSS score, CISA KEV listing, SSVC decision data, or POC indicator was supplied, so exploitation probability and automatability cannot be quantified from this input; the exploitation status is therefore 'no public exploit identified at time of analysis.' A notable cross-reference tension exists: the description names the 'Microsoft Graphics Component' (phrasing usually associated with the Windows GDI/graphics stack), yet the EUVD affected-product data scopes this strictly to Microsoft Office for Android (16.0.1 < 16.0.20430.20000) - verify the true affected surface with Microsoft, because it materially changes who is at risk. A memory-corruption EoP that requires user interaction and some existing foothold on an Android device is meaningfully harder to weaponize at scale than an unauthenticated server-side RCE, so despite the 8.0 score the realistic urgency is moderate: patch promptly but it is unlikely to be mass-exploited.

An attacker crafts a malicious document or image with a malformed graphics structure and delivers it to a victim running a vulnerable Microsoft Office build on Android. When the user opens the file, the Graphics Component overflows a stack buffer (CWE-121), letting the attacker corrupt memory and elevate privileges beyond the app's intended sandbox. Because the CVSS vector specifies UI:R and PR:L, success depends on the victim opening attacker-supplied content from an already-legitimate app context; no public exploit code is identified at this time.