Microsoft PowerPoint EUVD-2026-44218

Exploitation requires the victim to open (and interact with) an attacker-supplied malicious PowerPoint file in a vulnerable Office build - this is the concrete precondition encoded by AV:L and UI:R in the CVSS vector. No authentication or prior privileges are needed on the target (PR:N), so any user who opens the document can be compromised. Limiting factors that reduce real-world risk: the attack is not remote/zero-click, it depends on user action, and Office Protected View or Application Guard can block the parse path unless the user explicitly disables protection or trusts the file. The affected surface spans both Windows and macOS Office builds, so exploitation is not confined to a single platform.

The CVSS 3.1 base score is 7.8 (High) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - local attack vector, low complexity, no privileges, but user interaction required, with high confidentiality, integrity, and availability impact. The AV:L rating reflects that exploitation happens through a file the victim must open rather than over the network, and UI:R confirms the human-in-the-loop dependence, which materially lowers real-world exploitability compared to a zero-click network flaw. No EPSS score was provided in the input, so exploitation probability cannot be quantified here. It is not in CISA KEV and no POC was reported, so there is no evidence of active or public exploitation. Net assessment: a genuinely dangerous document-based RCE typical of Office parsers and a valid priority for patch cycles, but the required user interaction and local vector make it a phishing/social-engineering risk rather than an automatable, wormable threat.

An attacker emails a target a weaponized PowerPoint presentation (or hosts it on a lure site) that contains malformed structures triggering the heap overflow. When the victim opens the file in a vulnerable Office/PowerPoint build and interacts past Protected View, the corruption is used to execute attacker code in the user's security context. No public POC has been identified, and the local vector plus required user interaction mean success hinges on social engineering.