CVE-2026-105599: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2026-105599 Overview

CVE-2026-105599 is a heap-based buffer overflow vulnerability in Microsoft Office PowerPoint. An unauthorized attacker can execute arbitrary code over a network by convincing a user to open a crafted PowerPoint file. The flaw is tracked under CWE-122: Heap-based Buffer Overflow and affects Microsoft 365 Apps, Microsoft 365, Office 2021, and Office 2024 on both Windows and macOS.

Successful exploitation grants the attacker code execution in the context of the current user, enabling installation of malware, data theft, or lateral movement.

Critical Impact
Remote code execution through a malicious PowerPoint file. User interaction is required, but no authentication or privileges are needed on the target system.

Affected Products

Microsoft 365 Apps (Enterprise, x86 and x64)
Microsoft 365 for macOS
Microsoft Office LTSC 2021 and Office LTSC 2024 (x86, x64, and macOS)

Discovery Timeline

2026-10-13 - CVE-2026-105599 published to NVD
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-105599

Vulnerability Analysis

The vulnerability resides in how Microsoft PowerPoint parses presentation file structures on the heap. When PowerPoint processes a specially crafted file, it writes data beyond the bounds of an allocated heap buffer. The out-of-bounds write corrupts adjacent heap metadata or object pointers.

An attacker who controls the overflow contents can overwrite function pointers or virtual table entries. This redirects control flow to attacker-supplied code. Because PowerPoint runs with the privileges of the signed-in user, the attacker inherits those privileges.

The Exploit Prediction Scoring System (EPSS) currently places this issue in the 44th percentile, and no public exploit has been observed. The attack requires user interaction, which raises exploitation complexity but does not eliminate risk from phishing campaigns.

Root Cause

The root cause is insufficient bounds checking during parsing of a structured element inside a PowerPoint presentation. The parser trusts a length or offset field embedded in the file without validating it against the allocated buffer size.

Attack Vector

An attacker delivers a weaponized .pptx or legacy .ppt file through email, chat, a web download, or a file-sharing service. When the victim opens the file in a vulnerable PowerPoint version, the parser triggers the overflow and executes attacker code. Preview panes and automated document conversion pipelines can expand the attack surface.

No verified public proof-of-concept code exists at the time of writing. See the Microsoft Security Update Guide for vendor technical details.

Detection Methods for CVE-2026-105599

Indicators of Compromise

PowerPoint child processes spawning command interpreters such as cmd.exe, powershell.exe, or wscript.exe
Unexpected network connections initiated by POWERPNT.EXE to untrusted external hosts
Dropped executables or scripts in %APPDATA%, %TEMP%, or user profile directories following a document open event
Crashes or abnormal termination of POWERPNT.EXE with heap corruption exceptions in the Windows Application event log

Detection Strategies

Hunt for process ancestry where POWERPNT.EXE is the parent of LOLBin processes or scripting hosts
Alert on PowerPoint writing executable file types (.exe, .dll, .scr, .lnk, .hta) to disk
Inspect inbound email attachments and shared file links for .ppt, .pptx, and .ppsx files from untrusted senders

Monitoring Recommendations

Enable detailed process creation logging (Windows Event ID 4688) with command-line auditing
Forward Office telemetry and endpoint process events into a centralized analytics platform for correlation
Monitor for Office application crashes paired with subsequent network callbacks from the same user session

How to Mitigate CVE-2026-105599

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all affected Office installations
Prioritize patching endpoints used by high-risk roles such as executives, finance, and users who frequently receive external documents
Verify Microsoft 365 Apps are on a supported update channel and that automatic updates completed successfully

Patch Information

Microsoft has published guidance and updates through the Microsoft Security Update Guide. Administrators should deploy the October 2026 security updates for Microsoft 365 Apps, Office 2021 LTSC, and Office 2024 LTSC across Windows and macOS endpoints.

Workarounds

Open untrusted PowerPoint files in Protected View and block exit from Protected View through Group Policy
Disable the preview pane for PowerPoint files in Outlook and Windows Explorer to prevent parsing on hover
Use Attack Surface Reduction rules to block Office applications from creating child processes and writing executable content
Route inbound Office documents through a sandboxed detonation and content disarm and reconstruction (CDR) service

bash

# Enable Attack Surface Reduction rules via PowerShell
# Block Office applications from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled

# Block Office applications from creating executable content
Set-MpPreference -AttackSurfaceReductionRules_Ids 3B576869-A4EC-4529-8536-B80A7769E899 -AttackSurfaceReductionRules_Actions Enabled