Threat Investigation
Request a demo

CVE-2026-81955

High

Description

Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.

SeverityHigh
CVSS8.8
Exploit probability—
ProductMicrosoft 365 Apps for Enterprise
PublishedSep 8, 2026
First seenSep 8, 2026
Weakness typeCWE-122CWE-122

How to fix

Update
  • Microsoft Microsoft 365 Apps for Enterprise16.0.20326.20138 or later
  • Microsoft Microsoft Office 201616.0.5569.1003 or later
  • Microsoft Microsoft Office 201916.0.10417.20207 or later
  • Microsoft Microsoft Office 365 for Mac16.113.26091433 or later
  • Microsoft Microsoft Office LTSC 202116.0.14334.20906 or later
  • Microsoft Microsoft Office LTSC 202416.0.17932.20976 or later
  • Microsoft Microsoft Office LTSC for Mac 202116.113.26091433 or later
  • Microsoft Microsoft Office LTSC for Mac 202416.113.26091433 or later
  • Microsoft Windows 10 Version 160710.0.14393.9504 or later
  • Microsoft Windows 10 Version 180910.0.17763.9245 or later
  • Microsoft Windows 10 Version 21H210.0.19044.7725 or later
  • Microsoft Windows 10 Version 22H210.0.19045.7725 or later
Patches

Affected products

ProductAffected versionsFixed in
Microsoft Microsoft 365 Apps for Enterprise16.0.1 ≤ v < 16.0.20326.2013816.0.20326.20138
Microsoft Microsoft Office 201616.0.0 ≤ v < 16.0.5569.100316.0.5569.1003
Microsoft Microsoft Office 201919.0.0 ≤ v < 16.0.10417.2020716.0.10417.20207
Microsoft Microsoft Office 365 for Mac1.0.0 ≤ v < 16.113.2609143316.113.26091433
Microsoft Microsoft Office LTSC 202116.0.1 ≤ v < 16.0.14334.2090616.0.14334.20906
Microsoft Microsoft Office LTSC 202416.0.0 ≤ v < 16.0.17932.2097616.0.17932.20976
Microsoft Microsoft Office LTSC for Mac 202116.0.1 ≤ v < 16.113.2609143316.113.26091433
Microsoft Microsoft Office LTSC for Mac 202416.0.0 ≤ v < 16.113.2609143316.113.26091433
Microsoft Windows 10 Version 160710.0.14393.0 ≤ v < 10.0.14393.950410.0.14393.9504
Microsoft Windows 10 Version 180910.0.17763.0 ≤ v < 10.0.17763.924510.0.17763.9245
Microsoft Windows 10 Version 21H210.0.19044.0 ≤ v < 10.0.19044.772510.0.19044.7725
Microsoft Windows 10 Version 22H210.0.19045.0 ≤ v < 10.0.19045.772510.0.19045.7725
Microsoft Windows 11 version 23H210.0.22631.0 ≤ v < 10.0.22631.758210.0.22631.7582
Microsoft Windows 11 Version 23H210.0.22631.0 ≤ v < 10.0.22631.758210.0.22631.7582
Microsoft Windows 11 Version 24H210.0.26100.0 ≤ v < 10.0.26100.944510.0.26100.9445
Microsoft Windows 11 Version 25H210.0.26200.0 ≤ v < 10.0.26200.944510.0.26200.9445
Microsoft Windows 11 version 26H110.0.28000.0 ≤ v < 10.0.28000.295410.0.28000.2954
Microsoft Windows Server 20126.2.9200.0 ≤ v < 6.2.9200.263496.2.9200.26349
Microsoft Windows Server 2012 (Server Core installation)6.2.9200.0 ≤ v < 6.2.9200.263496.2.9200.26349
Microsoft Windows Server 2012 R26.3.9600.0 ≤ v < 6.3.9600.233986.3.9600.23398
Microsoft Windows Server 2012 R2 (Server Core installation)6.3.9600.0 ≤ v < 6.3.9600.233986.3.9600.23398
Microsoft Windows Server 201610.0.14393.0 ≤ v < 10.0.14393.950410.0.14393.9504
Microsoft Windows Server 2016 (Server Core installation)10.0.14393.0 ≤ v < 10.0.14393.950410.0.14393.9504
Microsoft Windows Server 201910.0.17763.0 ≤ v < 10.0.17763.924510.0.17763.9245
Microsoft Windows Server 2019 (Server Core installation)10.0.17763.0 ≤ v < 10.0.17763.924510.0.17763.9245
Microsoft Windows Server 202210.0.20348.0 ≤ v < 10.0.20348.562210.0.20348.5622
Microsoft Windows Server 202510.0.26100.0 ≤ v < 10.0.26100.3343810.0.26100.33438
Microsoft Windows Server 2025 (Server Core installation)10.0.26100.0 ≤ v < 10.0.26100.3343810.0.26100.33438

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.