Microsoft PowerPoint CVE-2026-41102

Exploitation requires local access to a device running Microsoft PowerPoint for Android at a version below 16.0.19822.20190, together with the low-level authorization indicated by CVSS PR:L (an 'authorized attacker' per Microsoft) - this is not remotely reachable (AV:L), which is the key limiting factor. No user interaction is needed (UI:N), and the scope is unchanged (S:U). The practical constraints that reduce real-world risk are: the attacker must already be a local, authorized party on the specific Android device, must be on an unpatched build, and must operate against the PowerPoint app context; there is no network path and no observed automatable or in-the-wild exploitation (SSVC Exploitation: none).

The signals converge on genuine-but-not-urgent risk. The CVSS 3.1 base score of 7.1 is driven by C:H/I:H, but the vector is local (AV:L) with required privileges (PR:L), which sharply limits reach - an attacker must already have authorized local access to the device/app. Corroborating this, EPSS is 0.04% (12th percentile) and CISA's SSVC framework reports Exploitation: none and Automatable: no, so despite Technical Impact rated 'total' there is no evidence of real-world exploitation. Note a tension worth verifying: Microsoft describes the impact as 'spoofing' (typically an integrity/authenticity concern), yet the NVD vector asserts Confidentiality:High and Integrity:High with Availability:None - the high-confidentiality rating is not obviously explained by a spoofing description and should be confirmed against the MSRC advisory. There is no KEV listing and no POC referenced, so this is a standard-priority mobile-client patch, not an emergency.

An attacker with legitimate low-privilege access to an Android device - for example a shared, jailbroken, or MDM-loosely-managed device, or via another app running in the same local context - abuses the improper access control in PowerPoint to render a presentation or dialog that spoofs trusted content or identity, tricking the victim or downstream reviewer into treating attacker-controlled material as authentic. No user interaction is required per the CVSS vector, and no public exploit code is identified at time of analysis, so this would require original development against the local flaw.