Microsoft PowerPoint CVE-2026-97005

Exploitation requires an attacker to deliver a specially crafted PowerPoint file and for the victim to open it in a vulnerable build (AV:L + UI:R), so this is a file-parsing attack dependent on social engineering rather than remote network exploitation. No authentication is required (PR:N), and default configurations are affected - no special feature or non-default setting is needed. The primary limiting factors are the mandatory user interaction (the victim must open the attacker-supplied document) and the local/file-based delivery, which together prevent automated mass exploitation (consistent with SSVC Automatable=no). Impact is confined to information disclosure (memory read); there is no code execution, data modification, or denial of service.

This is a moderate-severity information-disclosure issue (CVSS 5.5) whose signals are consistent and point to LOW real-world urgency rather than a top priority. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N indicates a local attack vector requiring user interaction (opening a crafted file), with no authentication (PR:N) but only confidentiality impact (C:H, I:N, A:N) and no scope change. CISA's SSVC decision framework corroborates low urgency: Exploitation=none, Automatable=no, Technical Impact=partial - meaning no observed exploitation and an attack that cannot be reliably automated at scale. There is no CISA KEV listing and no public exploit identified at time of analysis, so there is no public exploit identified at time of analysis. No EPSS probability was provided in the input, so exploitation likelihood cannot be quantified numerically. The one notable tension is the C:H rating paired with CWE-125 (out-of-bounds read): Microsoft frequently rates Office read primitives as High confidentiality, but an OOB read typically leaks adjacent process memory rather than a fully attacker-chosen secret, so treat C:H as the vendor's conservative worst case. Overall this is a genuine but non-urgent patch-in-normal-cycle issue, not an emergency.

An attacker crafts a malicious PowerPoint presentation that triggers an out-of-bounds read when parsed and emails or otherwise delivers it to a victim. When the victim opens the file in a vulnerable Office/PowerPoint build, the flaw discloses fragments of process memory (potentially including sensitive data or information useful for defeating ASLR) to the attacker. No public exploit code is identified at time of analysis, and exploitation requires the victim to actively open the file.