EUVD-2026-44218
GHSA-jhv5-3wc2-f8jm
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File-based document RCE: local vector (AV:L) with required user interaction (UI:R) to open the file, no privileges (PR:N), and full code-execution impact yielding C:H/I:H/A:H.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker run arbitrary code when a victim opens a maliciously crafted presentation file. The flaw affects a broad Office footprint - PowerPoint 2016, Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and multiple Office for Mac builds - and requires user interaction (opening the file) but no prior privileges. A vendor patch is available via MSRC; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
The vulnerability is a heap-based buffer overflow (CWE-122) in PowerPoint's file-parsing code. When PowerPoint deserializes a specially crafted presentation (e.g., PPT/PPTX/OpenXML structures), a length or bounds miscalculation causes attacker-controlled data to be written past the bounds of a heap-allocated buffer, corrupting adjacent heap metadata or object pointers. Controlled heap corruption of this class is commonly leveraged to hijack control flow and achieve arbitrary code execution in the context of the user running PowerPoint. Per the CPE data, the affected component ships across the Office platform on both Windows (Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021/2024, PowerPoint 2016) and macOS (Office 365 for Mac, Office LTSC for Mac 2021/2024), indicating the defect lives in shared cross-platform parsing code rather than a single OS-specific binary.
RemediationAI
Apply the Microsoft security update for CVE-2026-55043; Patch available per vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55043 - the exact fixed build depends on your Office channel (Current Channel, Monthly Enterprise, LTSC 2021/2024, or the Mac builds), so pull the specific patched version from the MSRC update guide rather than assuming a single number. For endpoints that cannot be patched immediately, reduce exposure by opening untrusted PowerPoint files in Protected View / Application Guard (which sandboxes the parser), and by using Office Group Policy to block or force Protected View for files originating from the internet and email; the trade-off is that Protected View disables editing until the user explicitly trusts the file, which can generate user friction. Additionally, filter presentation attachments (.ppt/.pptx/.pps) at the mail gateway and reinforce user awareness against opening unsolicited presentations, accepting that attachment blocking may impede legitimate business workflows.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Numeric truncation error (CWE-197) in Microsoft Office Word triggers local information disclosure when a user opens a ma
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Heap Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today