EUVD-2026-56461
GHSA-w4w4-4f94-xgg7
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local vector confirmed by incomplete cleanup producing on-host artifacts; PR:N as no privileges needed to read residual data; UI:R since victim must interact with a file first.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Incomplete cleanup in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.
AnalysisAI
Incomplete resource cleanup in Microsoft Office PowerPoint exposes sensitive document data to local attackers across multiple supported product lines, including Microsoft 365 Apps for Enterprise, Office LTSC 2024, LTSC 2021, Office 2019, and PowerPoint 2016. Exploitation requires a victim to open or interact with a PowerPoint file (UI:R), after which residual data - likely temporary files, memory buffers, or cached presentation content - persists in a locally accessible state without requiring attacker privileges. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, keeping real-world risk moderate despite the high confidentiality impact rating.
Technical ContextAI
CWE-459 (Incomplete Cleanup) describes a class of vulnerabilities where an application fails to fully erase or release sensitive resources - such as temporary files, memory pages, registry entries, or swap content - after their intended use. In this case, Microsoft PowerPoint leaves behind insufficiently sanitized data following file processing or presentation rendering. The local attack vector (AV:L) is consistent with residual data persisting on-disk or in accessible memory regions on the same host. Affected product lines span Office LTSC 2024 (from 16.0.0), LTSC 2021 (from 16.0.1), Microsoft 365 Apps for Enterprise (from 16.0.1), Office 2019 (from 19.0.0), and PowerPoint 2016 (16.0.0 through 16.0.5565.1000), as confirmed by EUVD-2026-56461 source data.
RemediationAI
Apply the vendor-released patch through Microsoft Update or the appropriate Office update channel. For Microsoft PowerPoint 2016, the confirmed fixed build is 16.0.5565.1001 - upgrade to this version or later. For Microsoft 365 Apps for Enterprise, Office LTSC 2024, Office LTSC 2021, and Office 2019, consult the Office Security Releases page at https://aka.ms/OfficeSecurityReleases for the applicable update packages; exact fixed build numbers for these channels were not independently confirmed in available source data beyond the reference to that advisory. As a compensating control where immediate patching is not feasible, restrict local system access to trusted users only, disable shared or multi-user sessions on workstations that routinely process sensitive presentations, and configure endpoint DLP or file integrity monitoring on PowerPoint temporary file directories (typically %TEMP% and %LOCALAPPDATA%\Microsoft\Office) to detect unauthorized reads. Note that these controls reduce exposure opportunity but do not eliminate the underlying incomplete cleanup behavior.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Same weakness CWE-459 – Incomplete Cleanup
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today