What is the CVSS score of CVE-2026-70320?

CVE-2026-70320 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.5%.

Is there a patch available for CVE-2026-70320?

Yes, a patch is available for CVE-2026-70320. Update the affected software to the latest version immediately.

Microsoft PowerPoint CVE-2026-70320

EUVD-2026-56579 MEDIUM

Improper Input Validation (CWE-20)

2026-08-11 secure@microsoft.com

GHSA-gwm7-j573-x6m8

Information Disclosure Microsoft 365 Apps Microsoft 365 Office 2021 Office 2024 Office 2019

5.5

CVSS 3.1 · NVD

Severity by source

Vendor (microsoft) PRIMARY

MEDIUM

qualitative

NVD

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.5 MEDIUM

Local file-open trigger with user interaction required; no attacker privileges needed; impact is confidentiality-only with no integrity or availability effect.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 22:06 vuln.today

Patch available

Aug 11, 2026 - 18:19 EUVD

CVE Published

Aug 11, 2026 - 17:19 nvd

MEDIUM 5.5

DescriptionNVD

Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.

AnalysisAI

Information disclosure in Microsoft Office PowerPoint stems from improper input validation (CWE-20) that allows a locally-present attacker to read sensitive data from the vulnerable system when a user opens a crafted file. Affected products span PowerPoint across Office 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise on both Windows and macOS. No public exploit code or active exploitation has been identified at the time of analysis; a vendor patch is available via standard Office update channels.

Technical ContextAI

CWE-20 (Improper Input Validation) indicates PowerPoint's file-parsing code fails to adequately validate attacker-controlled input, likely within a document format handler (e.g., PPTX/PPT structure parsing). The CVSS vector AV:L/UI:R confirms the vulnerability is triggered locally when a user opens a specially crafted presentation file, rather than through a network-accessible service. Affected CPE scope covers multiple Office release trains: Office 2019 (19.0.0), LTSC 2021 (16.0.1), LTSC 2024 (16.0.0), and Microsoft 365 Apps for Enterprise (16.0.1) on Windows, plus Office LTSC for Mac 2021 (16.0.1), LTSC for Mac 2024 (16.0.0), and Office 365 for Mac. The confidentiality-only impact (C:H/I:N/A:N) is consistent with out-of-bounds read or path traversal patterns that leak memory contents or local file data without achieving code execution.

RemediationAI

Apply the Microsoft-released security update for your Office version. Windows deployments of Office 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise should update through Microsoft Update or the Office CDN; the patched build reference is available at https://aka.ms/OfficeSecurityReleases. macOS deployments should update to build 16.112.26081010 or later for Office LTSC for Mac 2021, Office LTSC for Mac 2024, and Office 365 for Mac. If immediate patching is not possible, a targeted compensating control is to configure Protected View to open all externally-sourced PowerPoint files in read-only sandbox mode (File > Options > Trust Center > Protected View) - this limits the exposure surface by preventing full file parsing until the user explicitly enables editing, though it does not eliminate the vulnerability entirely. Block delivery of unsolicited .pptx/.ppt files at the email gateway as an additional layer.