Microsoft PowerPoint CVE-2026-88203

Exploitation requires the victim to open a specially crafted Microsoft Office PowerPoint file (UI:R); it cannot be triggered without that user action. No authentication is required (PR:N, unauthenticated), and no non-default configuration is indicated - any affected Office build that opens the malicious presentation is exposed. Affected products are Microsoft Office LTSC 2021 (before 16.0.14334.20974), Microsoft Office LTSC 2024 (before 16.0.17932.21056), and Microsoft 365 Apps for Enterprise (fixed build referenced via Microsoft's Office security releases page). The key limiting factors are the mandatory user interaction and the confidentiality-only impact (information disclosure, no code execution, integrity, or availability effect), which together cap realistic risk well below the raw reachability of the network attack vector.

Signals are consistently moderate-to-low, not high priority. CVSS is 6.5 (MEDIUM) with AV:N/AC:L/PR:N/UI:R - network-reachable and unauthenticated but gated by required user interaction (opening a crafted file), and impact is confidentiality-only (C:H/I:N/A:N), so this is a pure information-disclosure bug with no integrity or availability effect. CISA SSVC reinforces low urgency: Exploitation=none, Automatable=no, Technical Impact=partial. There is no CISA KEV listing and no public POC in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' EPSS is NOT provided in the input, so exploitation probability cannot be quantified - this is a data gap, not a low score. The 'over a network' phrasing in the description is consistent with AV:N only in the sense of attacker-controlled file delivery; actual triggering still requires local victim action (UI:R), so treat 'network' as a delivery/reachability descriptor rather than a remote-code-exec style exposure. Net: a legitimate patch-in-normal-cycle item, elevated only by the ubiquity of Microsoft Office, not by any evidence of active or automatable exploitation.

An attacker crafts a malicious PowerPoint presentation that triggers an untrusted pointer dereference (CWE-822) when parsed, then delivers it via phishing email or a web download link. When the victim opens the file (UI:R), the flaw dereferences an attacker-influenced pointer and leaks sensitive process memory, which can be disclosed back to the attacker. No public exploit code is identified at time of analysis, and the attack cannot proceed without the user opening the file.