Microsoft PowerPoint CVE-2026-108455

Exploitation requires the victim to open a specially crafted PowerPoint file (UI:R) in a vulnerable Office build - one of Microsoft 365 Apps for Enterprise, Office 365 for Mac, Office LTSC 2021/2024, or Office LTSC for Mac 2021/2024 per the CPE list. No authentication or elevated privileges are needed (PR:N), and no special non-default Office configuration is indicated by the data. The primary limiting factor is the mandatory user interaction: the attack fails unless a user is socially engineered into opening the malicious presentation, and Protected View / Mark-of-the-Web sandboxing on files from untrusted sources further constrains realistic exploitation.

This is a moderate-severity information disclosure flaw (CVSS 6.5) in Microsoft Office PowerPoint rooted in CWE-125 (out-of-bounds read). The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N indicates that although the attack vector is network, successful exploitation REQUIRES user interaction (UI:R) - the victim must open a malicious presentation file - which materially lowers real-world risk compared to a zero-click network flaw. Privileges are not required (PR:N, unauthenticated) and complexity is low (AC:L), but the user-interaction gate means this is not wormable or automatable. Impact is confined to confidentiality (C:H / I:N / A:N): it can leak memory contents (potentially useful for defeating ASLR or harvesting sensitive data) but cannot by itself modify data or crash the application. No EPSS score, KEV listing, or public exploit was provided in the input; there is no public exploit identified at time of analysis and no evidence of active exploitation, so this reads as a real-but-not-urgent patch priority rather than an emergency. The 'Buffer Overflow' tag is slightly imprecise - CWE-125 is an out-of-bounds READ (over-read / disclosure), not a classic out-of-bounds write - which is consistent with the confidentiality-only impact. All signals are internally consistent; no conflicting data was observed.

An attacker crafts a malicious PowerPoint presentation that triggers an out-of-bounds read when parsed, then delivers it to a victim via email or a download link. When the victim opens the file in a vulnerable Office build, the flaw leaks adjacent process memory back to attacker-controlled content, exposing sensitive data or information useful for bypassing memory protections. No public proof-of-concept was provided in the input, and exploitation depends entirely on the user opening the crafted file (UI:R).