Microsoft PowerPoint CVE-2026-108454

Exploitation requires the victim to open a maliciously crafted PowerPoint file in a vulnerable build of Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, or the corresponding macOS Office editions (Office 365 for Mac, Office LTSC for Mac 2021/2024). No authentication is required of the attacker (PR:N), and no special product configuration is needed - default PowerPoint file-parsing behavior is sufficient. The principal limiting factor is mandatory user interaction (UI:R): the attack cannot proceed unless a user is socially engineered into opening the attacker-supplied document, and Protected View / Mark-of-the-Web handling for files from untrusted sources can further blunt automatic exploitation. Impact is confined to confidentiality (memory disclosure); there is no integrity or availability effect from this flaw alone.

This is a moderate-priority confidentiality issue rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5) indicates a remotely-deliverable, unauthenticated, low-complexity flaw whose single mitigating factor is required user interaction (UI:R) - the victim must open a malicious PowerPoint file. CWE-126 (buffer over-read) combined with C:H/I:N/A:N is consistent with a memory-disclosure bug: the attacker reads adjacent process memory (potentially leaking heap contents, addresses useful for ASLR bypass, or document data) but cannot modify data or crash/deny service through this metric set. No EPSS score, SSVC decision, KEV listing, or POC indicator was provided in the input; per CISA KEV absence and no POC signal, there is no public exploit identified at time of analysis. The practical risk is therefore social-engineering-bound: unlike a wormable network bug, exploitation requires luring a user to open a crafted file, which places this below actively-exploited Office RCE chains in urgency. No conflicting signals were detected between the CVSS vector and the description - both point to a remote, user-interaction-gated information disclosure. A patch is available from Microsoft, so remediation is straightforward.

An attacker crafts a malicious PowerPoint presentation that triggers an out-of-bounds buffer read when parsed, then emails or shares it with a target. When the victim opens the file in a vulnerable Office/PowerPoint build, the flaw leaks adjacent process memory back to attacker-controlled content, potentially exposing sensitive in-memory data or address-layout information useful for chaining further exploits. No public exploit code was identified at time of analysis, and successful exploitation depends entirely on the user opening the file.