CVE-2026-70312: PowerPoint Information Disclosure Flaw

CVE-2026-70312 Overview

CVE-2026-70312 is an information disclosure vulnerability in Microsoft Office PowerPoint caused by improper input validation ([CWE-20]). An unauthorized local attacker can exploit the flaw to disclose sensitive information from the target system. Exploitation requires user interaction, such as opening a maliciously crafted PowerPoint file.

The issue carries a CVSS 3.1 base score of 5.5 (Medium). No public proof-of-concept code is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability sits at 0.352%, indicating low near-term exploitation likelihood.

Critical Impact
Successful exploitation exposes confidential in-process data to a local attacker without requiring elevated privileges, only user interaction to open a crafted file.

Affected Products

Microsoft Office PowerPoint (per the Microsoft CVE-2026-70312 Advisory)
Specific affected builds and channels are enumerated in the vendor advisory
Refer to Microsoft Security Update Guide for supported version coverage

Discovery Timeline

2026-08-11 - CVE-2026-70312 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-70312

Vulnerability Analysis

The vulnerability originates in how Microsoft PowerPoint parses and validates structured content within presentation files. Improper input validation ([CWE-20]) permits crafted file elements to trigger unintended read behavior during document processing. The result is disclosure of information that should remain inaccessible to the file's contents.

Exploitation is confined to the local attack surface. An attacker must deliver a malicious .pptx or related PowerPoint format file to a user and induce them to open it. Once opened, the file's malformed structures cause PowerPoint to expose data such as heap memory contents or file system fragments accessible to the process.

The vulnerability does not permit code execution or file modification. Confidentiality is the sole security property affected. Integrity and availability remain intact based on the CVSS vector.

Root Cause

The root cause is missing or insufficient validation of untrusted input parsed from PowerPoint document structures. Specific parser fields fail to enforce bounds or type expectations before use, allowing controlled inputs to influence read operations. Microsoft has not publicly disclosed the affected code path.

Attack Vector

An attacker crafts a malicious PowerPoint file and delivers it through email attachments, shared drives, collaboration platforms, or drive-by download. The target user must open the file in a vulnerable version of PowerPoint. Preview panes and automatic document rendering may also trigger the parsing logic in some configurations.

The vulnerability manifests during document parsing. See the Microsoft CVE-2026-70312 Advisory for vendor-provided technical details.

Detection Methods for CVE-2026-70312

Indicators of Compromise

Unexpected POWERPNT.EXE process activity following delivery of PowerPoint attachments from untrusted sources
PowerPoint files with malformed OOXML structures or unusual embedded objects flagged by document scanners
Outbound network requests from POWERPNT.EXE to unfamiliar hosts following file open events
Crash telemetry or Windows Error Reporting entries referencing PowerPoint parsing modules

Detection Strategies

Deploy endpoint telemetry to capture PowerPoint child processes, file open events, and DLL loads
Ingest email gateway logs into a security data lake to correlate delivered attachments with endpoint execution
Apply behavioral rules that identify Office applications reading sensitive files outside expected paths
Use YARA rules for malformed OOXML structures targeting known Office parser weaknesses

Monitoring Recommendations

Monitor Microsoft Defender and third-party AV signature updates for detections referencing CVE-2026-70312
Track Office telemetry for repeated crashes on document open, which may indicate exploitation attempts
Alert on PowerPoint launching from temporary directories or web browser download folders
Review DLP alerts for unusual data staging after PowerPoint document activity

How to Mitigate CVE-2026-70312

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-70312 Advisory as soon as it is available for your channel
Inventory PowerPoint installations across managed endpoints and prioritize patching for high-risk users
Enable Protected View for files originating from the internet and other untrusted locations
Reinforce user awareness training regarding unsolicited Office attachments

Patch Information

Microsoft has issued a security update addressing CVE-2026-70312. Administrators should consult the vendor advisory and deploy the applicable update through Microsoft Update, Windows Server Update Services (WSUS), Microsoft Intune, or the Click-to-Run channel for Microsoft 365 Apps.

Workarounds

Enforce Protected View and Application Guard for Office to sandbox untrusted documents
Block or quarantine inbound PowerPoint attachments from external senders at the email gateway pending patch deployment
Restrict opening of PowerPoint files from network shares and removable media using Group Policy
Disable the Outlook and File Explorer preview handlers for PowerPoint formats on high-value systems

bash

# Example Group Policy setting to enforce Protected View for files from the internet
# User Configuration > Administrative Templates > Microsoft PowerPoint > PowerPoint Options > Security > Trust Center > Protected View
# Set: "Do not open files from the Internet zone in Protected View" = Disabled