Microsoft PowerPoint EUVD-2026-44221

Exploitation requires the victim to open an attacker-supplied malicious PowerPoint/Office presentation file - user interaction (UI:R) is mandatory and is the primary limiting factor. No authentication or prior privileges are needed on the target (PR:N), and no special product configuration is required beyond a default, unpatched Office/PowerPoint install on Windows or macOS. Exploitation is limited by the need for social engineering to deliver and open the file, by Office Protected View which sandboxes internet-origin documents, and by the code running only at the current user's privilege level (Scope:Unchanged, no automatic privilege escalation).

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H yields 7.8 (High): local attack vector, low complexity, no privileges, but mandatory user interaction, with high impact to all three security properties. AV:L combined with UI:R is the standard 'user opens a malicious document' pattern - the attacker does not need network reachability or credentials, but does need the victim to open the file. No EPSS score was supplied, the CVE is not in CISA KEV, and no POC is referenced, so this reads as a real-but-not-emergency patch-cycle priority rather than an actively exploited threat. The main uncertainty is that no EPSS/POC signal is available to gauge exploitation likelihood; the high prevalence of Office means it remains an attractive phishing payload despite the required user interaction.

An attacker emails or shares a specially crafted PowerPoint presentation and lures a user into opening it, for example as a fake meeting deck or invoice slide. When PowerPoint parses the malformed structure, the heap overflow corrupts memory and executes attacker-supplied code in the user's security context. No public exploit is identified at time of analysis, and the local vector plus required user interaction (AV:L/UI:R) mean success depends on social engineering the victim into opening the file.