What is the CVSS score of CVE-2026-70316?

CVE-2026-70316 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.5%.

Is there a patch available for CVE-2026-70316?

Yes, a patch is available for CVE-2026-70316. Update the affected software to the latest version immediately.

Microsoft PowerPoint CVE-2026-70316

EUVD-2026-56571 MEDIUM

Improper Input Validation (CWE-20)

2026-08-11 secure@microsoft.com

GHSA-r9qw-w4mc-xchp

Information Disclosure Microsoft 365 Apps Microsoft 365 Office 2021 Office 2024 Office 2019

5.5

CVSS 3.1 · NVD

Severity by source

Vendor (microsoft) PRIMARY

MEDIUM

qualitative

NVD

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.5 MEDIUM

Local file-based trigger (AV:L) with mandatory user open action (UI:R); no target-system privileges required from attacker (PR:N); impact is confidentiality-only with no integrity or availability effect.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 22:09 vuln.today

Patch available

Aug 11, 2026 - 18:19 EUVD

CVE Published

Aug 11, 2026 - 17:19 cve.org

MEDIUM 5.5

DescriptionNVD

Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.

AnalysisAI

Improper input validation in Microsoft Office PowerPoint enables local information disclosure when a victim opens a specially crafted presentation file. The vulnerability spans Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office 2019, and their macOS counterparts across both subscription and perpetual-license release tracks. Microsoft has released patches via the standard Office update channel; no public exploit has been identified at time of analysis.

Technical ContextAI

The root cause is CWE-20 (Improper Input Validation) in PowerPoint's file-parsing logic, where the application fails to adequately validate or sanitize input data when processing a crafted presentation. PowerPoint handles complex binary (.ppt) and XML-based (.pptx) file formats; malformed structures within these formats can cause the parser to access unintended memory regions or expose data beyond the intended scope of the document being processed. The CVSS vector (AV:L/AC:L/PR:N/UI:R) confirms that exploitation occurs locally when a user opens a malicious file - not through any network-exposed service. Affected products span Windows and macOS editions across multiple Office release tracks, including perpetual-license (LTSC 2021, LTSC 2024, Office 2019) and subscription-based (Microsoft 365 Apps) editions, as confirmed by the EUVD-2026-56571 advisory data.

RemediationAI

Apply Microsoft's security update through the standard Office update mechanism for your release track. For Windows deployments (Microsoft 365 Apps, Office LTSC 2024/2021, Office 2019), follow the patching instructions at https://aka.ms/OfficeSecurityReleases. For macOS deployments, upgrade to version 16.112.26081010 or later for Office 365 for Mac, Office LTSC for Mac 2024, and Office LTSC for Mac 2021. As a compensating control prior to patching, enforce Office Protected View via Group Policy (File Block Settings) to prevent full parsing of externally sourced .ppt and .pptx files - note that Protected View does not cover all code paths and is not a substitute for patching. Additionally, configure email gateway controls to sandbox or quarantine unsolicited Office attachments to reduce delivery surface. Exact fix version numbers for Windows builds are not independently enumerable from the available data; use the https://aka.ms/OfficeSecurityReleases reference to identify the correct build for your channel.