CVE-2026-42831
HighUpdated
Published: 12 May 2026
Published
12 May 2026
Modified
22 May 2026
KEV Added
—
Patch
—
CVSS Score v3.1
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score
0.0006
19.5th percentile
Risk Priority
16
60% EPSS · 20% KEV · 20% CVSS
Summary
CVE-2026-42831 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Microsoft 365 Copilot. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 19.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-29711
Vulnerability details
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
Why these techniques?
Heap buffer overflow in Microsoft Office directly enables client-side code execution (T1203).
Confidence: HIGH · MITRE ATT&CK Enterprise v18.1
CVEs Like This One
CVE-2026-40363Same product: Microsoft 365 Copilot
CVE-2025-49697Same product: Microsoft 365 Copilot
CVE-2026-26110Same product: Microsoft 365 Copilot
CVE-2025-62554Same product: Microsoft 365 Copilot
CVE-2025-62557Same product: Microsoft 365 Copilot
CVE-2025-24057Same product: Microsoft Office
CVE-2025-49695Same product: Microsoft 365 Copilot
CVE-2025-21395Same product: Microsoft Office
CVE-2025-21186Same product: Microsoft Office
CVE-2026-40362Same product: Microsoft Office
Affected Assets
microsoft
365 copilot
≤ 16.0.19822.20190
microsoft
office
2024
microsoft
office long term servicing channel
2021
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.