EUVD-2026-56581
GHSA-24c6-hjh6-qgjx
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
File must be opened locally (AV:L), no system privileges needed (PR:N), user must open the file (UI:R), only confidentiality impacted (C:H/I:N/A:N).
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.
AnalysisAI
Local information disclosure in Microsoft PowerPoint stems from improper input validation (CWE-20) when processing specially crafted presentation files, affecting a broad range of Office product lines on both Windows and macOS. The CVSS vector (AV:L/UI:R/C:H) confirms that while no special system privileges are required, a victim must open a malicious file, making social engineering the primary delivery mechanism. No public exploit has been identified and no active exploitation is confirmed, but the high confidentiality impact (C:H) warrants prompt patching given the ubiquitous deployment of Microsoft Office.
Technical ContextAI
The vulnerability is classified under CWE-20 (Improper Input Validation), indicating that PowerPoint's file parsing logic fails to adequately validate attacker-controlled input within a crafted presentation. This class of flaw typically arises in format parsers that trust field lengths, type markers, or embedded data without bounds or type checking, potentially exposing memory regions or file system content. The CVSS local attack vector (AV:L) places the exploitation context within the file-handling layer - the vulnerability is surfaced when Office loads the file into the parsing subsystem. Affected products span Windows-based editions (Office 2019, LTSC 2021, LTSC 2024, Microsoft 365 Apps for Enterprise) and macOS editions (Office LTSC for Mac 2021, LTSC for Mac 2024, Office 365 for Mac), indicating the vulnerable code path exists across both platform implementations of PowerPoint.
RemediationAI
Apply the vendor-released patch immediately via Microsoft Update or the Microsoft Update Catalog. For macOS editions, the confirmed fixed version is 16.112.26081010, applicable to Office LTSC for Mac 2021, LTSC for Mac 2024, and Office 365 for Mac - update via the Microsoft AutoUpdate utility or organizational MDM. For Windows editions (Office 2019, LTSC 2021, LTSC 2024, Microsoft 365 Apps for Enterprise), refer to https://aka.ms/OfficeSecurityReleases for the specific fixed build numbers. As a compensating control where patching is not immediately possible, configure Protected View in Office Trust Center settings to prevent automatic execution of content from untrusted sources - note this may disrupt workflows that rely on editing files directly from email or downloads. Restricting macro and external content execution via Group Policy (DisableAllActiveX, Protected View for internet-zone files) further limits the attack surface without blocking read access. Block delivery of .pptx/.ppt files from external mail sources if business requirements allow.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today