EUVD-2026-29688
GHSA-4qv5-2qmr-5xhv
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Local authorized attacker (AV:L/PR:L) and a spoofing/authenticity impact map to Integrity:High; no clear confidentiality or availability loss, so C:N/A:N, diverging from NVD's C:H.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Improper access control in Microsoft Office PowerPoint allows an authorized attacker to perform spoofing locally.
AnalysisAI
Spoofing in Microsoft PowerPoint for Android (versions 16.0.0.0 through 16.0.19822.20189) lets an authorized local attacker misrepresent content or identity by abusing improper access control (CWE-284). The flaw requires low-privilege local access and no user interaction per the CVSS vector, and there is no public exploit identified at time of analysis; EPSS is very low at 0.04% (12th percentile) and CISA SSVC scores exploitation as 'none', indicating no observed activity despite a 'total' technical-impact rating. Microsoft has released a fixed build.
Technical ContextAI
The affected component is the Microsoft PowerPoint app for Android (CPE cpe:2.3:a:microsoft:microsoft_powerpoint_for_android), part of the Microsoft 365/Office mobile suite. The root cause is classified as CWE-284 (Improper Access Control), meaning the application fails to correctly enforce restrictions on an action or resource, allowing a party with some local authorization to bypass an intended trust or identity boundary. Microsoft categorizes the security impact as spoofing, so the weakness is leveraged to present content or an identity as trusted/legitimate when it is not, rather than to directly corrupt files or crash the app.
RemediationAI
Vendor-released patch: update Microsoft PowerPoint for Android to build 16.0.19822.20190 or later, which is the first fixed version per the EUVD affected-version range; the update is distributed through Google Play and Microsoft 365 app updates, so enabling automatic app updates or pushing the update via MDM/Intune is the primary and complete fix. Consult the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41102 for build confirmation. Because exploitation requires local, authorized access to the app/device, effective compensating controls until patching are device-level: enforce device lock, restrict which apps and profiles can access the PowerPoint container via Intune app-protection policies, and limit multi-user/shared-device access - the trade-off being reduced convenience on shared or kiosk devices. No feature-disable workaround is documented by the vendor, so patching is the recommended path.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today