CVE-2026-70320 Overview
CVE-2026-70320 is an improper input validation vulnerability [CWE-20] in Microsoft Office PowerPoint. The flaw allows an unauthorized attacker to disclose sensitive information locally when a targeted user opens a specially crafted PowerPoint file. Exploitation requires user interaction but no prior authentication.
Microsoft published the advisory on 2026-08-11 and last updated the entry on 2026-08-11. The vulnerability affects the confidentiality of data accessible to the local user account. It does not impact integrity or availability of the host system.
Critical Impact
A local attacker can leverage a malicious PowerPoint document to leak information from the victim's context, aiding follow-on attacks such as credential theft or reconnaissance.
Affected Products
- Microsoft Office PowerPoint (see Microsoft Security Update CVE-2026-70320 for the full list of impacted builds)
Discovery Timeline
- 2026-08-11 - CVE CVE-2026-70320 published to NVD
- 2026-08-11 - Last updated in NVD database
Technical Details for CVE-2026-70320
Vulnerability Analysis
CVE-2026-70320 stems from improper input validation within Microsoft Office PowerPoint's handling of document content. When PowerPoint parses a malformed or maliciously structured presentation file, it fails to correctly validate specific input fields. This validation gap causes the application to expose information that should remain isolated from the document's rendering context.
The issue is classified under [CWE-20] Improper Input Validation. Successful exploitation returns data from the user's session, which can include memory contents, file path references, or other locally accessible artifacts. The vulnerability is not wormable and cannot be triggered remotely without user interaction. Its EPSS probability is 0.477% with a percentile of 38.979 as of 2026-08-13.
Root Cause
The root cause lies in PowerPoint accepting document input without enforcing sufficient structural or content validation. Missing checks allow attacker-supplied data to influence parsing pathways that read from unintended memory or file locations. Microsoft's advisory identifies this as an information disclosure condition rather than a code execution flaw.
Attack Vector
An attacker crafts a malicious PowerPoint file and delivers it through email, a file-sharing service, or a compromised web link. The victim must open the file in a vulnerable PowerPoint client for the disclosure to occur. Because the attack vector is local and requires user interaction, phishing and social engineering are the primary delivery methods.
No public proof-of-concept, exploit code, or exploitation activity has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical specifics beyond Microsoft's advisory are not publicly available. See the Microsoft Security Update CVE-2026-70320 for vendor guidance.
Detection Methods for CVE-2026-70320
Indicators of Compromise
- Inbound .pptx, .ppt, or .ppsx attachments from untrusted senders, especially with unusual embedded objects or references.
- PowerPoint processes (POWERPNT.EXE) reading from unexpected file paths or generating outbound network requests shortly after opening a document.
- Anomalous child processes spawned from PowerPoint following document open events.
Detection Strategies
- Inspect email gateways and endpoint telemetry for PowerPoint files delivered from external sources and correlate with user open events.
- Monitor Office telemetry logs and Windows Event logs for PowerPoint file open activity paired with sensitive file or memory access patterns.
- Apply YARA or content-based rules against inbound Office files to flag malformed structures consistent with input-validation abuse.
Monitoring Recommendations
- Enable Microsoft Office cloud policy and audit logging to capture document open events with file source metadata.
- Forward endpoint and Office logs to a centralized SIEM for correlation with email delivery events.
- Alert on PowerPoint processes accessing credential stores, browser data directories, or making outbound HTTP/S connections.
How to Mitigate CVE-2026-70320
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-70320 advisory to all PowerPoint installations.
- Prioritize patching for users who routinely receive Office documents from external senders.
- Reinforce user awareness training on the risks of opening unsolicited PowerPoint files.
Patch Information
Microsoft has published the fix through its standard update channels. Review the Microsoft Security Update CVE-2026-70320 advisory for the exact build numbers and channels (Current Channel, Monthly Enterprise Channel, Semi-Annual Enterprise Channel, and Microsoft 365 Apps). Deploy through Microsoft Update, WSUS, Intune, or Configuration Manager as appropriate for the environment.
Workarounds
- Open untrusted PowerPoint files in Protected View to limit access to local resources.
- Enforce Office File Block policies to restrict opening of legacy or untrusted PowerPoint formats.
- Use Attack Surface Reduction (ASR) rules to block Office applications from creating child processes or accessing sensitive locations.
# Configuration example: enable Protected View for files originating from the Internet
# HKCU\Software\Microsoft\Office\<version>\PowerPoint\Security\ProtectedView
reg add "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
