Microsoft patches multiple remote code execution flaws in Office and Windows graphics

Microsoft disclosed and patched several remote code execution vulnerabilities affecting Microsoft Office, Excel, and Windows graphics components, including CVE-2026-42831, CVE-2026-26108, CVE-2025-49742, CVE-2024-49031, CVE-2024-49065, and CVE-2026-35421. The issues span Office document handling, Excel, the Office Graphics stack, the Windows Graphics Component, and Windows GDI, indicating broad exposure across common user-facing software used to process files and render content.

Microsoft said CVE-2026-42831 is a heap-based buffer overflow in Microsoft Office that can allow code execution when a user opens a malicious Office file. The flaw carries a CVSS 7.8 score, requires user interaction, and is not exploitable through the Preview Pane; Microsoft also said it was not publicly disclosed, not observed in the wild, and assessed as less likely to be exploited, with a security fix available. The related advisories point to a recurring risk pattern in which crafted documents or graphics content can trigger code execution on victim systems, reinforcing the need to prioritize patching for Office and Windows rendering components.