What is the CVSS score of CVE-2026-70312?

CVE-2026-70312 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Is there a patch available for CVE-2026-70312?

Yes, a patch is available for CVE-2026-70312. Update the affected software to the latest version immediately.

PowerPoint CVE-2026-70312

EUVD-2026-56567 MEDIUM

Improper Input Validation (CWE-20)

2026-08-11 secure@microsoft.com

GHSA-h7qr-m9m5-24w9

Information Disclosure Microsoft 365 Apps Microsoft 365 Office 2021 Office 2024 Office 2019

5.5

CVSS 3.1 · NVD

Severity by source

Vendor (microsoft) PRIMARY

MEDIUM

qualitative

NVD

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.5 MEDIUM

Local file-open required (AV:L), user must interact (UI:R), no privileges needed; only confidentiality impacted with no scope change.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 22:10 vuln.today

Patch available

Aug 11, 2026 - 18:19 EUVD

CVE Published

Aug 11, 2026 - 17:19 nvd

MEDIUM 5.5

DescriptionNVD

Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.

AnalysisAI

Local information disclosure in Microsoft Office PowerPoint exposes sensitive data when a user opens a crafted file. The flaw, rooted in improper input validation (CWE-20), affects a broad range of Office versions across Windows and macOS including Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and Office 2019. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; Microsoft has released patches via its August 2026 update cycle.

Technical ContextAI

CWE-20 (Improper Input Validation) indicates that PowerPoint's file-parsing code fails to adequately sanitize or bound-check attacker-controlled input - most likely within a crafted .pptx or legacy .ppt document. The CVSS vector (AV:L) confirms that exploitation is local in nature, consistent with a file-borne attack where the payload is delivered as a document. The flaw affects the PowerPoint component across multiple Office release trains on both Windows and macOS platforms, as identified through EUVD-2026-56567 and Microsoft's MSRC advisory. No CPE strings were provided in the source data, but affected product ranges are enumerated explicitly in the EUVD advisory.

RemediationAI

Apply Microsoft's August 2026 security updates immediately. For macOS deployments, update to build 16.112.26081010 or later across all affected Mac Office SKUs (Office 365 for Mac, LTSC for Mac 2021, LTSC for Mac 2024). For Windows deployments running Office 2019, LTSC 2021, LTSC 2024, or Microsoft 365 Apps for Enterprise, apply the current release per Microsoft's Office update guidance at https://aka.ms/OfficeSecurityReleases. Where patching is temporarily not possible, a compensating control is to configure email gateway policies to block or sandbox inbound .pptx/.ppt files from external senders, reducing the primary delivery vector; note this does not protect against files shared via internal collaboration tools or USB media. Disabling macros alone is insufficient mitigation, as this is a parsing-layer flaw, not a macro execution issue.