CVE-2026-72938: Microsoft 365 Apps Information Disclosure

CVE-2026-72938 Overview

CVE-2026-72938 is a type confusion vulnerability in Microsoft Office PowerPoint that allows an unauthorized attacker to disclose sensitive information over a network. The flaw is tracked under CWE-822: Untrusted Pointer Dereference and stems from PowerPoint accessing a resource using an incompatible type. Exploitation requires user interaction, typically opening a crafted presentation file. Successful attacks expose confidential in-process memory contents without affecting integrity or availability.

Critical Impact
An attacker who successfully exploits this vulnerability can read sensitive memory contents from a target PowerPoint process, potentially leaking data used to bypass address space layout randomization (ASLR) or chain into subsequent code execution attacks.

Affected Products

Microsoft 365 Apps (Enterprise, x86 and x64)
Microsoft 365 for macOS
Microsoft Office 2019, Office LTSC 2021, and Office LTSC 2024 (Windows and macOS)

Discovery Timeline

2026-09-08 - CVE-2026-72938 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-72938

Vulnerability Analysis

CVE-2026-72938 is a type confusion issue affecting Microsoft Office PowerPoint. Type confusion occurs when code allocates or accesses a resource using one type but later interprets that memory as a different, incompatible type. In PowerPoint, this mismatch allows the parser to dereference pointers or read fields whose actual layout differs from what the code expects.

The result is an out-of-bounds read within the PowerPoint process. Attackers use the leaked memory to enumerate object addresses, defeat ASLR, or exfiltrate document data resident in memory. The vulnerability does not modify data or crash the application, which allows exploitation to proceed silently.

The network attack vector reflects the delivery method rather than a remote service. An attacker hosts a malicious .pptx or .ppt file on a website, file share, or email attachment, then convinces the victim to open it. Once opened, the crafted file structures trigger the incompatible type access during parsing or rendering.

Root Cause

The underlying weakness maps to CWE-822: Untrusted Pointer Dereference. PowerPoint fails to validate that an object retrieved from a presentation file matches the type expected by downstream code. Malformed records inside the OOXML or legacy binary format cause the parser to reinterpret memory boundaries and expose bytes that should remain isolated.

Attack Vector

Exploitation follows a familiar Office document workflow. The attacker delivers a crafted PowerPoint file through phishing email, a compromised website, or a shared drive. When the victim opens the file, PowerPoint parses embedded structures containing manipulated type identifiers or object references. The type confusion condition triggers, and the attacker receives disclosed content through a data exfiltration channel embedded in the document, such as remote template loading or external content requests.

No verified proof-of-concept code is publicly available. Technical specifics beyond the CWE classification have not been released. See the Microsoft Security Update for CVE-2026-72938 for authoritative details.

Detection Methods for CVE-2026-72938

Indicators of Compromise

Unexpected .pptx, .ppt, .ppsx, or .potx files arriving through email or downloaded from untrusted sources.
PowerPoint processes (POWERPNT.EXE) making outbound network connections to unfamiliar domains shortly after document open.
Office child processes spawning script interpreters or invoking mshta.exe, wscript.exe, or powershell.exe following a presentation launch.

Detection Strategies

Inspect inbound email attachments and web downloads for PowerPoint files with embedded external references or unusual OLE objects.
Correlate Office telemetry with endpoint process trees to identify anomalous document parsing followed by outbound HTTP/S traffic.
Deploy behavioral analytics that flag Office applications accessing sensitive local files or credential stores after opening a presentation.

Monitoring Recommendations

Enable Microsoft Defender attack surface reduction (ASR) rules covering Office applications and log all triggered events.
Forward Office and Sysmon telemetry into a centralized data lake for cross-source correlation and retention.
Monitor Microsoft Security Response Center advisories and Patch Tuesday releases for updated guidance on this CVE.

How to Mitigate CVE-2026-72938

Immediate Actions Required

Apply Microsoft's security update referenced in the MSRC advisory for CVE-2026-72938 across all Office and Microsoft 365 Apps installations.
Prioritize patching on endpoints belonging to users who routinely receive external presentations, including sales, marketing, and executive teams.
Validate that automatic updates for Microsoft 365 Apps and Office LTSC are enabled and reporting successful installation.

Patch Information

Microsoft has released updates through the standard servicing channels for Microsoft 365 Apps, Office 2019, Office LTSC 2021, and Office LTSC 2024 on Windows and macOS. Refer to the Microsoft Security Update Guide for build numbers and deployment packages specific to each channel.

Workarounds

Open untrusted PowerPoint files in Protected View and block editing until the source is verified.
Configure Group Policy to disable automatic loading of external content and remote templates in PowerPoint.
Use email gateway policies to strip or sandbox PowerPoint attachments originating from external senders until patching completes.

bash

# Example Group Policy registry keys to enforce Protected View for PowerPoint
reg add "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f