Microsoft PowerPoint CVE-2026-88183

Exploitation requires the victim to open a specially crafted PowerPoint file in an affected Office build (Microsoft 365 Apps for Enterprise, Office LTSC 2024/2021, and the macOS 2024/2021/365 editions listed in EUVD). The limiting factor is mandatory user interaction (UI:R) - there is no server-side or automatic trigger; the attacker cannot exploit a default idle installation without someone opening the malicious document. Impact is bounded to information disclosure (C:H, with I:N/A:N): the out-of-bounds read can leak process memory but does not itself grant code execution or modify data. No special non-default configuration is required beyond having a vulnerable Office version installed.

This is a moderate-severity information-disclosure flaw that signals are consistent in rating as NOT a top priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5) shows a network-reachable, low-complexity, unauthenticated issue, but the C:H/I:N/A:N impact profile confines it to confidentiality (memory disclosure) with no integrity or availability effect, and crucially requires user interaction (UI:R) - the victim must open a malicious file. CISA's SSVC framework reinforces a low-urgency picture: Exploitation=none (no observed exploitation), Automatable=no (UI:R breaks mass/automated exploitation), and Technical Impact=partial. KEV status is not present, so this is 'no public exploit identified at time of analysis.' EPSS and POC data were not supplied in the input and cannot be asserted either way. The one tension to flag: the vector is AV:N despite the attack being a file-parsing bug that realistically depends on email/web delivery plus a user opening the document - Microsoft conventionally scores document-handling bugs as AV:N, so treat 'network' as 'malicious file delivered over a network' rather than a remote drive-by. Net: a real but not emergency-grade issue; patch on a normal cycle.

An attacker emails or hosts a crafted PowerPoint file and lures a user into opening it; the malformed structure triggers an out-of-bounds read in the parser, leaking adjacent process memory (e.g., heap contents that could include pointers or residual sensitive data) back to attacker-controllable output. No public proof-of-concept is identified at time of analysis, and the UI:R requirement means the victim must actively open the file, so exploitation is targeted rather than automated.