Microsoft PowerPoint CVE-2026-105599

Exploitation requires a user to open a specially crafted PowerPoint file in a vulnerable Microsoft Office PowerPoint installation (UI:R - active user interaction). No authentication is required (PR:N - the attacker needs no account on the target). Limiting factors: successful code execution requires non-trivial, reliable heap corruption against modern memory-safety mitigations (AC:H), meaning exploit reliability is reduced and crafting a working exploit is non-trivial; delivery depends on social engineering (phishing or malicious download) to get the victim to open the file; Protected View / Office sandboxing and Mark-of-the-Web prompts may further impede exploitation on documents from untrusted sources. No special server-side configuration is required - the condition is simply opening the malicious document.

This is a moderate-to-high priority issue whose real-world risk is tempered by its exploitation requirements. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R) scores 7.5 and, consistent with Microsoft's convention for Office file-parsing flaws, treats email/web file delivery as a 'network' vector. Two signals materially reduce likelihood: AC:H indicates non-trivial exploitation (reliable heap grooming/corruption against modern mitigations such as ASLR/DEP and Office sandboxing), and UI:R means a user must open a malicious file - there is no wormable, zero-click path. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or available exploit code at this time. The impact triad (C:H/I:H/A:H) is appropriately high for arbitrary code execution in the user's context. Net: this is a classic weaponizable-document RCE that becomes a genuine priority if public exploit code emerges or if it is incorporated into phishing campaigns, but the AC:H and UI:R factors mean it is not a drop-everything mass-exploitation threat on current signals. Note the contrast: a 7.5 'High' score here reflects strong impact offset by meaningful attacker effort, not confirmed widespread risk.

An attacker crafts a malicious PowerPoint presentation that triggers the heap-based buffer overflow when parsed, then delivers it to a victim via phishing email or a web download. When the victim opens the file in a vulnerable version of Microsoft Office PowerPoint, the overflow is triggered and attacker-controlled code executes in the context of the user. No public proof-of-concept exploit is identified in the available data, and the CVSS AC:H rating indicates reliable exploitation requires non-trivial heap manipulation.