CVE-2026-105731: Microsoft Office Graphics Component Information Disclosure Vulnerability
Published Oct 13, 2026
·Updated
Microsoft Office Graphics Component Information Disclosure Vulnerability
Other sources
Use of uninitialized resource in Microsoft Graphics Component allows an authorized attacker to disclose information locally.
— Microsoft
Affected Software
2 affected componentsFixes available
Microsoft Office Graphics Component
Microsoft Office for Android<16.0.20430.20000
16.0.20430.20000
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.20430.20000
Event History
Oct 13, 2026
CVE Published
via Microsoft·02:00 PM
Data Sourced
via Microsoft·02:00 PM
DescriptionSeverityWeaknessAffected Software
CVE Published
via MITRE·06:59 PM
Data Sourced
via MITRE·06:59 PM
DescriptionSeverity
Frequently Asked Questions
1
Which software is identified as affected?
The affected software listed is Microsoft Office Graphics Component and Microsoft Office for Android.
2
What level of access does an attacker need to exploit this issue?
Exploitation requires local access and low privileges. The vulnerability description also characterizes the attacker as authorized.
3
Is user interaction required, and what is the expected security impact?
User interaction is not required. The CVSS vector indicates high confidentiality impact, with no integrity or availability impact.