CVE-2026-70313: PowerPoint Information Disclosure Flaw

CVE-2026-70313 Overview

CVE-2026-70313 is an improper input validation vulnerability [CWE-20] in Microsoft Office PowerPoint. The flaw allows an unauthorized attacker to disclose information locally by delivering a crafted PowerPoint file to a target user. Exploitation requires user interaction, typically opening a malicious presentation file. Microsoft published the advisory on August 11, 2026, with a CVSS 3.1 base score of 7.8.

The vulnerability also carries impact to integrity and availability under CVSS scoring, indicating exploitation can extend beyond simple data disclosure. The Exploit Prediction Scoring System (EPSS) rates exploitation likelihood at 0.332% (25.97 percentile) as of August 13, 2026.

Critical Impact
A crafted PowerPoint document opened by a local user can lead to information disclosure with high confidentiality, integrity, and availability impact on the affected system.

Affected Products

Microsoft Office PowerPoint (see Microsoft Security Update CVE-2026-70313 for specific builds)
Microsoft Office deployments that include PowerPoint
Systems where users open untrusted .pptx or .ppt files

Discovery Timeline

2026-08-11 - Microsoft publishes security advisory for CVE-2026-70313
2026-08-11 - CVE-2026-70313 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-70313

Vulnerability Analysis

The vulnerability stems from improper input validation within Microsoft Office PowerPoint when parsing document content. PowerPoint fails to correctly validate structured elements inside a presentation file before processing them. An attacker crafts a malicious presentation that triggers the parser flaw when the target user opens the file.

Successful exploitation results in information disclosure from the local user context. The attacker acts as an unauthorized party, meaning no prior authentication to the victim system is needed. However, the attack vector is local, so the malicious file must reach the target and be opened.

Root Cause

Microsoft categorizes the defect as improper input validation [CWE-20]. The PowerPoint parsing logic accepts malformed or unexpected input structures without adequate sanity checks. This condition permits reading data the application should not expose to the file's content stream or referenced object.

Attack Vector

The attack begins with delivery of a weaponized PowerPoint file through email, chat, shared drives, or web download. The victim must open the file in a vulnerable PowerPoint version. Once parsing begins, the crafted content triggers the flaw and exposes sensitive local information to attacker-controlled data paths within the document.

No public proof-of-concept, exploit code, or CISA Known Exploited Vulnerabilities (KEV) listing exists for CVE-2026-70313 at publication. Technical specifics beyond the CWE-20 classification are not disclosed in the public advisory. Refer to the Microsoft Security Update CVE-2026-70313 advisory for build-level details.

Detection Methods for CVE-2026-70313

Indicators of Compromise

Unexpected PowerPoint files (.ppt, .pptx, .pptm) received from untrusted sources or arriving via phishing campaigns
PowerPoint processes (POWERPNT.EXE) spawning unusual child processes or making outbound network connections shortly after file open
Access to sensitive files or credential stores by POWERPNT.EXE outside normal user activity patterns

Detection Strategies

Inspect email gateways and file-sharing platforms for PowerPoint attachments with malformed OOXML structures or embedded objects
Monitor endpoints for anomalous file reads originating from POWERPNT.EXE, especially reads of %APPDATA%, browser profile directories, or SSH key locations
Correlate PowerPoint document open events with subsequent DNS queries, HTTP POSTs, or SMB traffic that could exfiltrate disclosed information

Monitoring Recommendations

Enable Microsoft Office telemetry and forward Office alerts to the security operations center
Log Protected View bypasses and Mark-of-the-Web removals on Office files across managed endpoints
Track user reports of unexpected PowerPoint crashes or content-rendering errors that may indicate exploitation attempts

How to Mitigate CVE-2026-70313

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-70313 advisory across all managed endpoints
Prioritize patching for users who frequently receive external PowerPoint files, including executive assistants, sales, and marketing staff
Remind users to avoid opening PowerPoint attachments from unknown senders and to keep Protected View enabled

Patch Information

Microsoft has released a security update addressing CVE-2026-70313. Administrators should consult the Microsoft Security Update CVE-2026-70313 advisory for the exact KB numbers and click-to-run channels applicable to each Office version. Deploy the update through Microsoft Update, Windows Server Update Services (WSUS), Microsoft Intune, or Configuration Manager.

Workarounds

Enforce Office Protected View for files originating from the internet and Outlook attachments
Configure Office File Block policy to prevent opening legacy PowerPoint file formats when they are not required
Apply Attack Surface Reduction (ASR) rules that block Office applications from creating child processes and from injecting into other processes
Restrict macro execution using Group Policy for users who do not require macro-enabled PowerPoint content

bash

# Example: Enable Protected View for internet-origin files via Group Policy registry keys
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f