CVE-2026-108453: Microsoft 365 Apps Information Disclosure

CVE-2026-108453 Overview

CVE-2026-108453 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Office PowerPoint. The flaw allows an unauthorized attacker to disclose information over a network when a victim opens a crafted PowerPoint file. Exploitation requires user interaction but no prior authentication. The vulnerability affects Microsoft 365 Apps, Microsoft 365 for macOS, Office LTSC 2021, and Office LTSC 2024 across x86, x64, and macOS builds.

Critical Impact
Successful exploitation discloses sensitive process memory contents from the PowerPoint process, which can leak document data, memory layout, or credentials cached in memory.

Affected Products

Microsoft 365 Apps (Enterprise, x86 and x64)
Microsoft 365 for macOS
Microsoft Office LTSC 2021 and Office LTSC 2024 (x86, x64, macOS)

Discovery Timeline

2026-10-15 - CVE-2026-108453 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-108453

Vulnerability Analysis

The vulnerability is an out-of-bounds read in the PowerPoint file parser. When PowerPoint processes a specially crafted presentation, the parser reads memory beyond the bounds of an allocated buffer. The leaked bytes are returned to the attacker through content rendered or exported by the application, resulting in information disclosure.

The issue is scoped to confidentiality. Integrity and availability are not affected, meaning the attacker cannot modify data or crash the process reliably through this flaw alone. Exploitation occurs over a network because a victim typically retrieves the malicious document through email, a shared drive, or a web download. The attack succeeds only after the user opens the document.

Microsoft has not published an exploitation-in-the-wild notice, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The current EPSS probability is 0.514%.

Root Cause

The root cause is missing or incorrect bounds validation during parsing of a structured record inside the PowerPoint file format [CWE-125]. The parser trusts a length or offset field read from the file without verifying it against the actual buffer size. When the field exceeds the allocation, the subsequent read returns adjacent heap memory.

Attack Vector

The attacker crafts a PowerPoint file containing a malformed object, slide, or embedded record that triggers the oversized read. The file is delivered to the target through email attachments, instant-messaging platforms, cloud document shares, or a drive-by download. When the victim opens the file in a vulnerable PowerPoint build, the parser executes the vulnerable code path and the leaked data is returned to the attacker through document behavior that reflects memory content.

Microsoft has not released a public proof of concept. Refer to the Microsoft Security Update CVE-2026-108453 advisory for technical details.

Detection Methods for CVE-2026-108453

Indicators of Compromise

Inbound email attachments with .ppt, .pptx, .pps, or .ppsx extensions originating from unverified senders or newly observed domains.
PowerPoint processes (POWERPNT.EXE on Windows, Microsoft PowerPoint on macOS) spawning unexpected network connections immediately after opening a document.
Office telemetry events indicating application faults, crashes, or exception logs tied to presentation file parsing.

Detection Strategies

Hunt for PowerPoint processes making outbound HTTP, HTTPS, or SMB connections to low-reputation destinations shortly after document open events.
Correlate email gateway attachment metadata with endpoint document-open events to identify suspicious delivery chains.
Flag Office documents retrieved from external sources that bypass Mark-of-the-Web and open outside Protected View.

Monitoring Recommendations

Enable and forward Microsoft Office telemetry and Windows Event Log data to a central analytics platform for behavioral review.
Monitor endpoint detection and response (EDR) telemetry for anomalous child-process creation and memory-read patterns originating from Office applications.
Track patch deployment status across all Office SKUs and alert on hosts running pre-patch builds that open externally sourced presentations.

How to Mitigate CVE-2026-108453

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-108453 to all affected Office installations.
Enforce Protected View and Office Protected Mode for documents originating from the internet, email attachments, and unsafe locations.
Block or quarantine PowerPoint attachments from external senders at the email gateway until patches are confirmed deployed.

Patch Information

Microsoft has released security updates for Microsoft 365 Apps, Microsoft 365 for macOS, Office LTSC 2021, and Office LTSC 2024. Deploy the updates through Microsoft Update, Microsoft Intune, Microsoft Configuration Manager, or the AutoUpdate channel for macOS. Validate build numbers against the vendor advisory after deployment.

Workarounds

Open untrusted PowerPoint files only in Office Protected View or in a sandboxed environment such as Application Guard for Office.
Disable preview handlers for PowerPoint files in email clients and file explorers to prevent automatic parsing.
Restrict receipt of PowerPoint file types from external sources via mail flow rules or data loss prevention policies until patching completes.

bash

# Group Policy registry keys to enforce Protected View for PowerPoint
reg add "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f