Advisoriesby IbisMicrosoftCVE-2026-77491
Microsoft Windows GDI: out-of-bounds read
Fix: upgrade to 16.112.26090911 or later (9 fixed versions below)
Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information locally.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Microsoft Office 365 for Mac Product | >= 1.0.0, < 16.112.26090911 | 16.112.26090911 |
| Microsoft Office LTSC for Mac 2021 Product | >= 16.0.1, < 16.112.26090911 | 16.112.26090911 |
| Microsoft Office LTSC for Mac 2024 Product | >= 16.0.0, < 16.112.26090911 | 16.112.26090911 |
| Microsoft Office for Android Product | >= 16.0.1, < 16.0.20430.20000 | 16.0.20430.20000 |
| Windows 10 Version 1607 Product | >= 10.0.14393.0, < 10.0.14393.9512 | 10.0.14393.9512 |
| Windows 10 Version 1809 Product | >= 10.0.17763.0, < 10.0.17763.9245 | 10.0.17763.9245 |
| Windows 10 Version 21H2 Product | >= 10.0.19044.0, < 10.0.19044.7725 | 10.0.19044.7725 |
| Windows 10 Version 22H2 Product | >= 10.0.19045.0, < 10.0.19045.7725 | 10.0.19045.7725 |
| Windows 11 Version 23H2 Product | >= 10.0.22631.0, < 10.0.22631.7582 | 10.0.22631.7582 |
| Windows 11 Version 24H2 Product | >= 10.0.26100.0, < 10.0.26100.9445 | 10.0.26100.9445 |
| Windows 11 Version 25H2 Product | >= 10.0.26200.0, < 10.0.26200.9445 | 10.0.26200.9445 |
| Windows 11 version 23H2 Product | >= 10.0.22631.0, < 10.0.22631.7582 | 10.0.22631.7582 |
Changes since it was listed
Fixed in: Windows 10 Version 1607 10.0.14393.9512, Windows 10 Version 1809 10.0.17763.9245, Windows 10 Version 21H2 10.0.19044.772 to Microsoft Office 365 for Mac 16.112.26090911, Microsoft Office for Android 16.0.20430.20000, Microsoft Office LTSC for Mac 2021 16.112.26090911
Details and references
- CVSS 3.1
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-125