CVE-2026-108454: Microsoft 365 Apps Information Disclosure

CVE-2026-108454 Overview

CVE-2026-108454 is an information disclosure vulnerability in Microsoft Office PowerPoint caused by a buffer over-read [CWE-126]. An unauthorized attacker can craft a malicious PowerPoint file that, when opened by a user, leaks memory contents over a network. The flaw affects Microsoft 365 Apps, Microsoft 365 for macOS, Office LTSC 2021, and Office LTSC 2024 across both x86 and x64 builds.

Exploitation requires user interaction. The attacker typically delivers the crafted file through phishing, a link, or a shared document. Successful exploitation can expose process memory that may contain credentials, document contents, or address space information useful for chaining further attacks.

Critical Impact
A crafted PowerPoint file can disclose sensitive process memory to a remote attacker when opened, impacting both Windows and macOS Office installations.

Affected Products

Microsoft 365 Apps (Enterprise, x86 and x64)
Microsoft 365 for macOS
Microsoft Office LTSC 2021 and Office LTSC 2024 (x86, x64, and macOS)

Discovery Timeline

2026-10-15 - CVE-2026-108454 published to the National Vulnerability Database (NVD)
2026-10-19 - Last updated in NVD

Technical Details for CVE-2026-108454

Vulnerability Analysis

The issue is a buffer over-read in PowerPoint's file parsing logic. When PowerPoint processes a malformed presentation, it reads beyond the intended bounds of an allocated buffer. The excess bytes returned to internal routines can be reflected back to the attacker through document fields, rendered output, or network-facing telemetry triggered by the opened file.

Buffer over-reads classified under [CWE-126] do not corrupt memory, but they expose adjacent process memory. In Office processes, that memory often contains portions of other open documents, authentication tokens held by Office services, or pointers that defeat Address Space Layout Randomization (ASLR). The information disclosure can therefore serve as a precursor to code execution attacks against the same process.

The CVSS vector indicates network delivery with required user interaction, high confidentiality impact, and no integrity or availability impact. The EPSS probability is 0.503%.

Root Cause

The root cause is improper validation of a length or offset field inside a PowerPoint file structure. The parser trusts an attacker-controlled size value and reads past the end of the source buffer. Microsoft has not published parser internals, so the specific record type is not disclosed in the advisory.

Attack Vector

The attacker crafts a .pptx, .ppt, or related PowerPoint file containing malformed structural metadata. The file is delivered by email, chat, cloud share, or web download. When the victim opens the file in a vulnerable PowerPoint build, the parser performs the out-of-bounds read and the leaked data is returned to the attacker through content embedded in the file or through callbacks the document triggers.

No authentication is required on the attacker side, and the Protected View sandbox does not necessarily prevent the read because parsing occurs before full content rendering. Refer to the Microsoft Security Update Guidance for product-specific technical notes.

Detection Methods for CVE-2026-108454

Indicators of Compromise

Inbound email or chat attachments containing PowerPoint files from untrusted or newly registered senders, especially files with abnormally small or malformed OOXML part sizes.
PowerPoint processes (POWERPNT.EXE on Windows, Microsoft PowerPoint on macOS) initiating outbound network connections immediately after opening a document.
Office telemetry showing parser exceptions or crash dumps correlated with specific presentation files.

Detection Strategies

Hunt for PowerPoint child processes or network calls to uncommon destinations following document open events in endpoint telemetry.
Inspect email gateways for PowerPoint files that fail OOXML schema validation or contain oversize structure length fields.
Correlate Office application crash events (Windows Event ID 1000 with faulting module in PowerPoint binaries) with recently received files.

Monitoring Recommendations

Enable Microsoft Defender for Office 365 Safe Attachments or an equivalent sandbox to detonate incoming PowerPoint files before delivery.
Forward Office alerts, process creation, and network connection events into a centralized data lake for retrospective hunting once new indicators are published.
Track patch deployment status across all Office channels (Current, Monthly Enterprise, Semi-Annual, and LTSC) to identify unpatched endpoints.

How to Mitigate CVE-2026-108454

Immediate Actions Required

Apply the October 2026 Microsoft Office security updates referenced in the Microsoft Security Update Guidance to all affected Windows and macOS installations.
Prioritize patching for users who routinely open external PowerPoint files, including sales, executive, and support staff.
Verify that Office update channels are enabled and reporting successful installation through Microsoft Endpoint Manager or an equivalent tool.

Patch Information

Microsoft has issued updates for Microsoft 365 Apps, Microsoft 365 for macOS, Office LTSC 2021, and Office LTSC 2024. Build numbers vary by channel and platform; consult the vendor advisory for the exact fixed build for each SKU. There is no indication in the advisory of a configuration-only fix.

Workarounds

Enforce Office Protected View and Application Guard for files originating from the internet or email attachments.
Block or quarantine PowerPoint attachments at the email gateway until patches are confirmed deployed.
Instruct users to preview untrusted presentations in Office on the web, which is not listed as affected, rather than in the desktop client.

bash

# Example: enforce Protected View via Group Policy registry keys on Windows
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f