EUVD-2026-99805
GHSA-62fq-m24q-2jc7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious PowerPoint file
-
DeliveryDeliver via email or shared link
-
ExploitVictim opens file in PowerPoint
-
ExecutionTrigger out-of-bounds read in parser
-
ImpactDisclose adjacent process memory
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open an attacker-crafted PowerPoint file in Microsoft Office PowerPoint (UI:R); it cannot be triggered remotely or automatically without this local user action (AV:L). No special product configuration is needed - default PowerPoint installations are affected - but the mandatory user interaction of opening the malicious file is the primary limiting factor. Impact is confined to information disclosure (leaking process memory, C:H); there is no integrity or availability impact and no code execution. Affected products include Microsoft Office LTSC 2024/2021, Microsoft 365 Apps for Enterprise, and Office/Office LTSC for Mac editions per EUVD. |
| Impact | This is a moderate-severity (CVSS 5.5) information-disclosure flaw whose signals consistently point to LOW real-world urgency rather than a top priority. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) describes a local attack requiring the victim to open a malicious file (UI:R), yielding confidentiality impact only (C:H, I:N, A:N) - there is no code execution, integrity loss, or availability impact. CISA's SSVC framework reinforces low priority: Exploitation=none, Automatable=no, Technical Impact=partial. No EPSS score was provided; the CVE is NOT on CISA KEV, and no POC is referenced, so exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent - nothing here conflicts. The one nuance worth noting: although PR:N marks the attacker as 'unauthorized,' exploitation is gated by user interaction (opening a crafted PowerPoint file), which is the true limiting factor, not authentication. A vendor patch is available, so the pragmatic action is routine patch-cycle remediation, not emergency response. |
| Exploit ScenarioDerived | An attacker crafts a malicious PowerPoint presentation that triggers an out-of-bounds read (CWE-125) in Microsoft Office PowerPoint's file parser and delivers it to a victim via email or a shared link. When the victim opens the file, the parser reads memory beyond the intended buffer, potentially leaking adjacent process memory contents (e.g., heap data) back to the attacker. No public exploit code is identified at time of analysis, and the attack cannot proceed without the user opening the file. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Opening a specially crafted PowerPoint document can cause Microsoft PowerPoint to read beyond the bounds of an allocated memory buffer and disclose process memory contents to an attacker (CVSS 5.5, C:H/I:N/A:N). The flaw affects Microsoft Office LTSC 2024 and 2021, Microsoft 365 Apps for Enterprise, and the Mac editions of Office/Office LTSC, and exploitation requires the victim to open the malicious file locally (AV:L, UI:R, PR:N) - it cannot be triggered remotely or automatically. There is no evidence of active exploitation or public exploit code, CISA SSVC rates exploitation as none and automatable as no, and Microsoft has released vendor patches for the affected builds.
RemediationAI
Vendor-released patches are available: update Microsoft Office LTSC 2024 to build 16.0.17932.21056 or later and Microsoft Office LTSC 2021 to build 16.0.14334.20974 or later using Windows Update or the Office Click-to-Run updater, update Microsoft 365 Apps for Enterprise through the Office Security Releases channel (https://aka.ms/OfficeSecurityReleases) or the standard Monthly Enterprise/Current Channel update path, and update the Mac editions (Office LTSC for Mac 2024/2021 and Office 365 for Mac) via Microsoft AutoUpdate to the builds published in the Microsoft Security Update Guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97744), since EUVD records those Mac fixes as '<publication'. Because exploitation requires the user to open a malicious presentation, compensating controls are worth applying where patching is delayed: keep Mark-of-the-Web/Protected View enabled for documents from the internet and email so PowerPoint opens them in a restricted sandbox (trade-off: users must click 'Enable Editing' for legitimate files and some automation/integration flows break), deploy Microsoft Defender Application Guard or an equivalent container for untrusted Office files (trade-off: added latency and no hardware-accelerated rendering), and configure email/web gateways to quarantine or strip untrusted PowerPoint attachments (trade-off: false positives on business documents). Disabling macros is not a meaningful mitigation here since the flaw is in document parsing, not VBA execution, and there is no network port or endpoint to block - the exposure is the local file-open path only.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a CWE-125 out-of-bounds read in the code Microsoft PowerPoint uses to parse presentation files. When the parser processes a malformed document structure, it fails to validate an index or length field before dereferencing it, so data is read from memory outside the intended buffer and can be surfaced back to the attacker through the document's rendered content or output. Because this is an out-of-bounds read rather than a write, the expected consequence is information disclosure (confidentiality High) with no integrity or availability impact and no memory-corruption-based code execution; the 'Buffer Overflow' tag attached to the record is a loose categorization, and the authoritative CWE is CWE-125. The CVSS vector AV:L/UI:R/PR:N reflects that the attack surface is the local file-open path - the attacker delivers a document, not a network packet - and that no credentials or product configuration changes are needed, leaving the mandatory user interaction of opening the file as the primary limiting factor. SSVC's 'Automatable: no' and 'Technical Impact: partial' ratings are consistent with a targeted, user-driven disclosure bug rather than a wormable or self-propagating issue. CPE-referenced affected code lines include Microsoft Office LTSC 2024, Microsoft Office LTSC 2021, Microsoft Office LTSC for Mac 2024 and 2021, Microsoft Office 365 for Mac, and Microsoft 365 Apps for Enterprise.
Know when 365 Apps gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Attack is local via opening a crafted file (AV:L, UI:R) needing no privileges (PR:N); out-of-bounds read leaks memory giving confidentiality impact only (C:H, I:N, A:N).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Exploit-DB