CVE-2026-68809: PowerPoint Information Disclosure Flaw

CVE-2026-68809 Overview

CVE-2026-68809 is an information disclosure vulnerability in Microsoft Office PowerPoint caused by incomplete cleanup of resources [CWE-459]. An unauthorized attacker who convinces a user to open a crafted file can read information that PowerPoint failed to purge from memory or temporary storage. The issue is local in nature and requires user interaction, but does not require prior authentication on the target system. Microsoft published the advisory on August 11, 2026.

Critical Impact
Successful exploitation exposes sensitive in-memory or residual data from the PowerPoint process to a local attacker, potentially leaking document contents, credentials, or process artifacts.

Affected Products

Microsoft Office PowerPoint (see the Microsoft Security Update Guide for the exact affected builds)
Microsoft 365 Apps installations that include PowerPoint
Standalone Microsoft Office installations bundling PowerPoint

Discovery Timeline

2026-08-11 - Microsoft publishes CVE-2026-68809 in the Security Update Guide
2026-08-11 - CVE-2026-68809 published to the National Vulnerability Database (NVD)
2026-08-11 - Last updated in the NVD database

Technical Details for CVE-2026-68809

Vulnerability Analysis

CVE-2026-68809 is classified under [CWE-459: Incomplete Cleanup]. PowerPoint fails to fully release, zero out, or invalidate certain resources during document processing. Residual data remains reachable within the process context, and a crafted presentation file can guide the application into surfacing that data back to the attacker's controlled content structures. The result is a local information disclosure primitive that operates entirely in the context of the user opening the file.

The vulnerability requires user interaction. A victim must open the malicious PowerPoint document for the flaw to trigger. Integrity and availability are not affected, but confidentiality impact is high because leaked memory can contain fragments of other documents, authentication material, or application secrets loaded into the same process.

The EPSS probability at publication is approximately 0.35%, indicating low near-term exploitation likelihood, though the low complexity of exploitation may attract phishing-based delivery.

Root Cause

The root cause is incomplete resource cleanup within PowerPoint's file parsing or rendering pipeline. Memory buffers, temporary objects, or cached parsing artifacts are not fully cleared before subsequent operations reuse them. Crafted document structures reference these stale buffers, allowing their contents to be exposed to embedded objects or output paths under the attacker's control.

Attack Vector

Exploitation follows a client-side social engineering pattern. The attacker delivers a weaponized .pptx or related PowerPoint file through email, chat, or a file-sharing service. When the target opens the file, PowerPoint parses the crafted structures, and the incomplete cleanup path exposes residual data. The attacker retrieves the leaked information either through content the crafted document renders back to disk, through embedded outbound references, or through content the user is prompted to share.

No verified proof-of-concept code has been published. Refer to the Microsoft Security Update Guide entry for authoritative technical detail.

Detection Methods for CVE-2026-68809

Indicators of Compromise

Unexpected .pptx, .ppt, or .ppsx attachments arriving from external senders, especially with lure themes targeting executives or finance staff
PowerPoint processes (POWERPNT.EXE) spawning outbound network connections shortly after opening a document
Creation of unusual temporary files in %TEMP% or %LOCALAPPDATA%\Microsoft\Office following document open events

Detection Strategies

Hunt for POWERPNT.EXE reading sensitive user directories (Documents, Desktop, credential stores) immediately after opening an untrusted file
Alert on PowerPoint making outbound HTTP/S connections to non-Microsoft domains within seconds of a document open event
Correlate email gateway telemetry for PowerPoint attachments with endpoint document-open events to identify high-risk delivery chains

Monitoring Recommendations

Enable Microsoft Office telemetry and forward Microsoft-Office-Alerts and OAlerts event logs to the SIEM
Monitor Protected View and Mark-of-the-Web bypass events, since exploitation depends on the user opening the crafted file
Track outbound DNS and HTTP requests originating from Office processes and baseline expected destinations

How to Mitigate CVE-2026-68809

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide entry for CVE-2026-68809 across all endpoints running PowerPoint
Inventory Microsoft 365 Apps and standalone Office builds and confirm they are on a patched channel and revision
Reinforce user awareness that PowerPoint files from external sources should be opened only in Protected View

Patch Information

Microsoft has issued a security update addressed through the standard Microsoft Update, Microsoft 365 Apps update channels, and the Microsoft Update Catalog. Administrators should validate that PowerPoint client versions match or exceed the fixed build listed in the vendor advisory, then confirm deployment through configuration management reporting.

Workarounds

Enforce Protected View for files originating from the internet, Outlook attachments, and unsafe locations via Group Policy
Block or quarantine inbound PowerPoint attachments from untrusted senders at the email gateway until patching is verified
Disable the ability for Office applications to make outbound connections to untrusted destinations using Attack Surface Reduction rules where feasible

bash

# Configuration example: enforce Protected View via registry (per-user)
reg add "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f