EUVD-2026-56577
GHSA-3656-cj7q-mf85
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local file-open trigger (AV:L, UI:R), no prior privileges needed (PR:N), purely confidentiality impact with no integrity or availability effect.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.
AnalysisAI
Information disclosure in Microsoft Office PowerPoint enables a local attacker to obtain sensitive data from a victim's system by exploiting improper input validation (CWE-20) when processing a malicious file. Affected products span Windows and Mac editions including Office 2019, Microsoft 365 Apps for Enterprise, LTSC 2021/2024, and Office 365 for Mac - all requiring the victim to open a crafted PowerPoint file (UI:R). No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis; however, a vendor patch is available.
Technical ContextAI
The vulnerability resides in Microsoft PowerPoint's file parsing logic and is classified under CWE-20 (Improper Input Validation), meaning the application fails to adequately sanitize or bound-check attacker-controlled input embedded within a PowerPoint document. This root cause class is commonly associated with out-of-bounds reads, type confusion during deserialization, or logic errors in format parsers that allow memory regions containing sensitive data to be surfaced to the attacker. The CVSS vector (AV:L) confirms the exploitation path is local - the malicious file must be opened on the target machine. Affected CPE targets include Microsoft Office 365 for Mac (versions below 16.112.26081010), Office 2019, Microsoft 365 Apps for Enterprise, LTSC 2021 and 2024 for both Windows and Mac, and Office LTSC for Mac 2021 and 2024 (all below 16.112.26081010 on Mac). The scope is limited to the vulnerable system (S:U), and the impact is confined to confidentiality (C:H, I:N, A:N).
RemediationAI
Apply the vendor-released patch immediately. For all Mac-based Office editions (Office 365 for Mac, Office LTSC for Mac 2021, Office LTSC for Mac 2024), update PowerPoint to version 16.112.26081010 or later via Microsoft AutoUpdate or the Mac App Store. For Windows-based editions (Office 2019, Microsoft 365 Apps for Enterprise, LTSC 2021, LTSC 2024), obtain the current patched build from https://aka.ms/OfficeSecurityReleases - note that no exact Windows build number was independently confirmed in the available data; verify the installed build against Microsoft's release notes at that URL. The Microsoft Security Response Center advisory is at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70325. As a compensating control where patching is temporarily infeasible, enforce email gateway and endpoint policies that block or sandbox inbound .pptx/.ppt/.ppsx files until the patch is deployed; this reduces the most likely delivery vector but does not eliminate risk from files sourced through USB, cloud shares, or other channels.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today