CVE-2026-55043: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2026-55043 Overview

CVE-2026-55043 is a heap-based buffer overflow [CWE-122] in Microsoft Office PowerPoint. An unauthorized attacker can execute code locally when a user opens a crafted PowerPoint file. The vulnerability affects Microsoft 365 Apps, Microsoft 365 for macOS, Office 2019, Office 2021, Office 2024, and PowerPoint 2016 across x86, x64, and macOS builds. Microsoft published the advisory on July 14, 2026 and updated it on July 16, 2026. Exploitation requires user interaction, and no public proof-of-concept or in-the-wild exploitation has been reported at the time of publication.

Critical Impact
Successful exploitation grants attackers arbitrary code execution in the context of the user running PowerPoint, enabling malware deployment, credential theft, and lateral movement from a single opened document.

Affected Products

Microsoft 365 Apps (Enterprise, x86 and x64) and Microsoft 365 for macOS
Microsoft Office 2019, Office 2021 LTSC, and Office 2024 LTSC (x86, x64, macOS)
Microsoft PowerPoint 2016 (x86 and x64)

Discovery Timeline

2026-07-14 - Microsoft publishes advisory for CVE-2026-55043
2026-07-14 - CVE-2026-55043 published to the National Vulnerability Database (NVD)
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-55043

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow in the PowerPoint file-parsing code path. When PowerPoint processes a specifically crafted presentation, the application writes attacker-controlled data past the bounds of a heap-allocated buffer. This corrupts adjacent heap metadata or object pointers, giving an attacker a primitive to hijack execution flow.

Exploitation requires the victim to open a malicious .ppt, .pptx, or related PowerPoint file. Because the flaw executes in the security context of the current user, an attacker who lures a domain user into opening a document gains code execution with that user's privileges. This provides a reliable initial-access primitive for phishing campaigns targeting enterprise environments.

Root Cause

The root cause is classified under [CWE-122] Heap-based Buffer Overflow. The parser fails to validate a length or count field extracted from the malicious document before copying data into a fixed or under-sized heap allocation. The resulting out-of-bounds write corrupts heap structures that PowerPoint subsequently uses, enabling controlled memory corruption.

Attack Vector

The attack vector is local and requires user interaction. Delivery typically occurs through email attachments, malicious file shares, or drive-by downloads that instruct users to open the crafted PowerPoint document. No prior authentication to the target system is required beyond the victim opening the file. The scope is unchanged, meaning code executes as the invoking user rather than escaping to another security boundary. Refer to the Microsoft Security Update Guide for parser-specific technical details.

Detection Methods for CVE-2026-55043

Indicators of Compromise

PowerPoint (POWERPNT.EXE) spawning unexpected child processes such as cmd.exe, powershell.exe, wscript.exe, mshta.exe, or rundll32.exe.
Unusual outbound network connections initiated by POWERPNT.EXE shortly after a document is opened.
New files written to %APPDATA%, %TEMP%, or Startup folders by the PowerPoint process.
Anomalous PowerPoint crashes with heap corruption exceptions in Windows Event Log or Watson telemetry.

Detection Strategies

Hunt for PowerPoint process trees where POWERPNT.EXE is the parent of a scripting or LOLBin process.
Monitor for registry Run key additions or scheduled task creations originating from Office processes.
Inspect email gateways for .pptx, .ppt, .ppsx, and .potx attachments from untrusted senders and detonate in a sandbox.

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction (ASR) rules that block Office applications from creating child processes and log rule matches centrally.
Forward Sysmon Event IDs 1 (process create), 3 (network), and 11 (file create) from Office hosts to a SIEM for correlation.
Track Office build numbers across the fleet and alert when hosts remain on pre-patch versions.

How to Mitigate CVE-2026-55043

Immediate Actions Required

Apply the July 2026 Microsoft security updates for Microsoft 365 Apps, Office 2019, Office 2021, Office 2024, and PowerPoint 2016 on all Windows and macOS endpoints.
Enforce Protected View and Block Macros From The Internet policies for all Office applications.
Advise users to avoid opening PowerPoint attachments from unknown senders until patching is verified.

Patch Information

Microsoft has released fixes through the Microsoft Update channel and Click-to-Run for Microsoft 365 Apps. Consult the Microsoft CVE-2026-55043 advisory for exact build numbers per channel and follow standard Microsoft Update deployment procedures.

Workarounds

Enable the Office ASR rule Block all Office applications from creating child processes (GUID D4F940AB-401B-4EFC-AADC-AD5F3C50688A) in Block mode.
Configure File Block policy in the Trust Center to prevent opening legacy PowerPoint formats from untrusted locations.
Deliver untrusted presentations only through Office for the Web or another sandboxed viewer until patches are applied.

bash

# Enable ASR rule to block Office apps from spawning child processes (PowerShell)
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled