What happened
A vulnerability has been identified in Microsoft Office PowerPoint, classified as CVE-2026-108453. The flaw involves an out-of-bounds read condition that can be exploited via specially crafted PowerPoint files. When such a file is opened by an affected deployment, an attacker can potentially disclose sensitive information over the network. This vulnerability does not allow remote code execution but poses a risk of information disclosure, with the attack requiring user interaction to open malicious content. The exploitation path involves delivery of malicious PowerPoint files via email or malicious web content that is then opened by a user.
Who is affected
Organisations running Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, or Microsoft Office LTSC 2024 are affected. Vulnerable versions include those prior to specific updates from Microsoft, notably versions prior to 16.0.14334.20974 for Office LTSC 2021, and prior to 16.0.17932.21056 for Office LTSC 2024. The vulnerability is present across both Windows and Mac environments, affecting 32-bit and 64-bit configurations. As the flaw requires user interaction — specifically opening a malicious PowerPoint file — awareness and cautious handling of unsolicited content are crucial mitigation measures.
Recommended actions
- Implement mail and web content filtering to detect and block malicious files and web pages delivering crafted PowerPoint documents.
- Apply attack-surface reduction policies on software capable of opening PowerPoint files to mitigate the impact of malicious content execution.
- Increase user awareness and training to prevent opening files from untrusted sources or unsolicited email attachments.
