CVE-2026-55120: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2026-55120 Overview

CVE-2026-55120 is a heap-based buffer overflow vulnerability in Microsoft Office PowerPoint that allows an unauthorized attacker to execute code locally. The flaw is classified under [CWE-122] (Heap-based Buffer Overflow) and affects multiple Microsoft Office releases across Windows and macOS. Exploitation requires user interaction, typically by opening a crafted PowerPoint document. Successful exploitation results in arbitrary code execution in the context of the current user, compromising confidentiality, integrity, and availability of the affected system.

Critical Impact
An attacker who convinces a user to open a malicious PowerPoint file can execute arbitrary code locally with the privileges of the current user, enabling malware installation, credential theft, and lateral movement.

Affected Products

Microsoft 365 Apps (Enterprise x64 and x86)
Microsoft 365 for macOS
Microsoft Office 2019, Office 2021 LTSC, and Office 2024 LTSC (Windows and macOS)
Microsoft PowerPoint 2016 (x64 and x86)

Discovery Timeline

2026-07-14 - CVE-2026-55120 published to the National Vulnerability Database
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-55120

Vulnerability Analysis

The vulnerability resides in Microsoft PowerPoint's parsing of PowerPoint file structures. When PowerPoint processes a specially crafted presentation, it allocates a heap buffer whose size is derived from attacker-controlled fields in the file. Subsequent write operations exceed the allocated bounds, corrupting adjacent heap metadata and objects. Attackers can shape the heap layout to overwrite function pointers or virtual table entries, redirecting execution to attacker-controlled code. Because Office processes untrusted documents from email, cloud sync, and shared drives, the local attack vector translates into a practical remote delivery scenario via social engineering.

Root Cause

The root cause is improper validation of size or length values within a specific PowerPoint file structure before performing a heap write. The parser trusts embedded length fields without confirming they fit within the allocated destination buffer. This is a classic [CWE-122] heap-based buffer overflow pattern common in complex binary document formats.

Attack Vector

Exploitation requires an attacker to deliver a crafted .ppt, .pptx, or related PowerPoint file to a victim and convince the user to open it. Common delivery mechanisms include phishing emails with document attachments, malicious links to cloud-hosted files, and files staged on compromised network shares. Preview handlers and cached content can also trigger the vulnerable code path in some configurations.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Microsoft Security Response Center advisory for authoritative technical details.

Detection Methods for CVE-2026-55120

Indicators of Compromise

Unexpected child processes spawned by POWERPNT.EXE, such as cmd.exe, powershell.exe, wscript.exe, or rundll32.exe
PowerPoint process crashes or Windows Error Reporting entries referencing heap corruption during file open
Outbound network connections initiated directly by POWERPNT.EXE to uncategorized or newly registered domains
Suspicious PowerPoint files delivered via email attachments or downloaded from external file-sharing services

Detection Strategies

Deploy behavioral endpoint detection that flags code execution originating from Office processes, particularly script interpreters or LOLBins launched by PowerPoint
Enable Microsoft Defender Attack Surface Reduction (ASR) rules that block Office applications from creating child processes and injecting into other processes
Hunt for anomalous memory allocations and DLL loads within POWERPNT.EXE using EDR telemetry

Monitoring Recommendations

Ingest Office telemetry, Sysmon process creation events, and email gateway logs into a centralized SIEM for correlation
Alert on PowerPoint opening files from Downloads, Temp, or Outlook attachment cache directories followed by process spawning
Track patch compliance for Microsoft 365 Apps, Office 2019, Office 2021, Office 2024, and PowerPoint 2016 across all endpoints

How to Mitigate CVE-2026-55120

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-55120 to all affected Office installations
Prioritize patching for users who routinely handle external documents, including finance, HR, and executive assistants
Ensure Protected View and Office File Block policies are enforced for files originating from the Internet and untrusted locations
Educate users to avoid opening unexpected PowerPoint attachments, especially those requesting that Protected View be disabled

Patch Information

Microsoft has released security updates addressing CVE-2026-55120 for Microsoft 365 Apps, Microsoft 365 for macOS, Office 2019, Office 2021 LTSC, Office 2024 LTSC, and PowerPoint 2016. Consult the Microsoft CVE-2026-55120 update guide for the exact build numbers per channel and platform, and deploy through Microsoft Update, Configuration Manager, Intune, or your preferred patch management tool.

Workarounds

Enforce Protected View for files from the Internet, unsafe locations, and Outlook attachments through Group Policy
Enable ASR rule Block all Office applications from creating child processes (GUID D4F940AB-401B-4EFC-AADC-AD5F3C50688A)
Restrict opening of legacy binary .ppt files using Office File Block settings where compatibility permits
Route inbound email attachments through a sandboxing solution that detonates Office documents before delivery

bash

# Example: enable the ASR rule blocking Office child process creation via PowerShell
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled