CVE-2026-108455: Microsoft 365 Apps Information Disclosure

CVE-2026-108455 Overview

CVE-2026-108455 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Office PowerPoint. The flaw allows an unauthenticated attacker to disclose information over a network when a user opens a crafted PowerPoint file. Exploitation requires user interaction but no prior authentication to the target system. Microsoft tracks this issue in its Security Update Guide and has rated it as a network-exploitable information disclosure defect affecting multiple supported Office channels on Windows and macOS.

Critical Impact
Successful exploitation leaks sensitive in-process memory contents from PowerPoint, which may include document data, pointers, or other information useful for chaining further attacks.

Affected Products

Microsoft 365 Apps for Enterprise (x64 and x86)
Microsoft 365 on macOS
Microsoft Office LTSC 2021 and Office LTSC 2024 (x64, x86, and macOS)

Discovery Timeline

2026-10-15 - CVE-2026-108455 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-108455

Vulnerability Analysis

The vulnerability is an out-of-bounds read in PowerPoint's file parsing logic. When PowerPoint processes a malformed presentation, it reads memory outside the bounds of an allocated buffer. The data returned to the attacker can include adjacent heap contents, document fragments, or process memory artifacts.

Because the condition is a read rather than a write, it does not corrupt program state directly. However, the leaked bytes can defeat Address Space Layout Randomization (ASLR) and support exploit chains that pair this issue with a separate memory-corruption bug. The attack vector is network-based because malicious files can be delivered through email, cloud storage links, or web downloads.

Root Cause

The root cause is missing or incorrect bounds validation when parsing a structured field inside a PowerPoint file format (such as a legacy .ppt record or an Office Open XML part). The parser trusts an attacker-controlled length or offset value and reads past the end of its allocated buffer. This is a classic [CWE-125] pattern common in complex binary document parsers.

Attack Vector

An attacker crafts a malicious PowerPoint file and delivers it to a victim through phishing, a shared link, or a compromised website. The victim must open the file in a vulnerable version of PowerPoint. On open, the parser dereferences the attacker-controlled offset and returns out-of-bounds memory that can be exfiltrated through document behavior, embedded content, or follow-on actions. No elevated privileges or local access to the target host are required by the attacker.

No public proof-of-concept or exploit code is available for CVE-2026-108455. See the Microsoft Security Update Guide for authoritative technical details.

Detection Methods for CVE-2026-108455

Indicators of Compromise

PowerPoint (POWERPNT.EXE) crashes or Watson/Werfault telemetry generated shortly after opening a .ppt, .pptx, or .ppsx file from an untrusted source.
Inbound email or web downloads containing PowerPoint attachments from unknown senders, particularly files with unusual embedded objects or malformed OOXML parts.
Office processes spawning network connections to unexpected hosts immediately after document open.

Detection Strategies

Inspect email gateways and web proxies for PowerPoint attachments and apply content disarm and reconstruction (CDR) to strip unexpected structures.
Hunt for anomalous child processes or outbound connections originating from POWERPNT.EXE in EDR telemetry.
Correlate Office application crash events (Windows Event ID 1000, faulting module in Office binaries) with recent document opens from external sources.

Monitoring Recommendations

Forward Office telemetry, Microsoft Defender SmartScreen events, and endpoint process trees into a centralized data lake for retrospective hunting.
Alert on PowerPoint processes reading from or writing to unusual file paths, including temp directories used for staged exfiltration.
Track patch deployment coverage for Microsoft 365 Apps, Office 2021, and Office 2024 across all managed endpoints.

How to Mitigate CVE-2026-108455

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all affected Office installations.
Prioritize patching endpoints that routinely process externally sourced PowerPoint files, such as sales, HR, and executive assistant workstations.
Verify that Microsoft 365 Apps update channels are not paused and that macOS clients receive updates through AutoUpdate.

Patch Information

Microsoft has released fixes for Microsoft 365 Apps for Enterprise, Microsoft 365 on macOS, Office LTSC 2021, and Office LTSC 2024. Administrators should consult the vendor advisory for exact build numbers per channel and deploy through Microsoft Update, Intune, Configuration Manager, or AutoUpdate for macOS.

Workarounds

Enable Protected View and Office Application Guard so untrusted PowerPoint files open in an isolated container that limits information disclosure.
Block or quarantine PowerPoint attachments from external senders at the mail gateway until patches are confirmed deployed.
Enforce the Microsoft Office attack surface reduction (ASR) rule that blocks Office applications from creating child processes to limit post-exploitation chaining.

bash

# Configuration example: enable the ASR rule that blocks Office child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled