EUVD-2026-44221
GHSA-5wrg-wv69-274m
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must be opened locally by a user (AV:L, UI:R) with no prior privileges (PR:N); memory-corruption code execution grants full C/I/A impact within the user context.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.
AnalysisAI
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arises from a heap-based buffer overflow (CWE-122) triggered when a victim opens a maliciously crafted presentation file. An attacker who cannot log in to the target can still run code in the context of the current user by convincing that user to open the booby-trapped file, giving full confidentiality, integrity, and availability impact on the affected host. Microsoft has released a patch; there is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Technical ContextAI
The affected component is the file-parsing engine of Microsoft PowerPoint, shipped across Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021/2024, PowerPoint 2016, and the corresponding Office for Mac / Office LTSC for Mac 2021/2024 builds (per the provided CPE list). CWE-122 (heap-based buffer overflow) indicates the parser allocates a heap buffer and then writes past its bounds - typically because a length or count field embedded in the presentation file is trusted without validation against the actual allocation. Overwriting adjacent heap metadata or object pointers lets an attacker corrupt memory and ultimately hijack control flow to execute native code within the Office process.
RemediationAI
Apply the Microsoft-released security update for your Office channel - patch availability is confirmed by the vendor, though exact fixed build numbers were not provided in this data set; obtain them from the advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55120 and deploy via Microsoft Update, Click-to-Run, or your patch-management pipeline. Until patched, reduce exposure by enabling Protected View / Office Protected View for files originating from the internet and email (which opens untrusted presentations in a sandbox at the cost of blocking editing until the user opts in), blocking or quarantining .ppt/.pptx/.ppsx attachments at the mail gateway, and using Attack Surface Reduction rules to limit Office child-process creation (which can break legitimate macros or add-ins). User awareness against opening unsolicited presentation files is a supporting control.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Numeric truncation error (CWE-197) in Microsoft Office Word triggers local information disclosure when a user opens a ma
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Heap Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today