CVE-2026-72956: Microsoft 365 Apps Information Disclosure

CVE-2026-72956 Overview

CVE-2026-72956 is an information disclosure vulnerability in Microsoft Office PowerPoint caused by an untrusted pointer dereference [CWE-822]. An unauthenticated attacker can craft a malicious PowerPoint file that, when opened by a user, dereferences an attacker-controlled pointer and leaks memory contents over a network path. The flaw affects supported Microsoft Office builds including Microsoft 365 Apps, Office 2019, Office 2021 LTSC, and Office 2024 LTSC on both x86 and x64 architectures. Exploitation requires user interaction but no privileges, which fits standard phishing and document-delivery workflows.

Critical Impact
Successful exploitation lets a remote attacker read sensitive process memory from a user who opens a crafted PowerPoint document, potentially exposing credentials, tokens, or other in-memory data.

Affected Products

Microsoft 365 Apps (Enterprise, x86 and x64)
Microsoft Office 2019 and Office 2021 LTSC (x86 and x64)
Microsoft Office 2024 LTSC (x86 and x64)

Discovery Timeline

2026-09-08 - CVE-2026-72956 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-72956

Vulnerability Analysis

The vulnerability resides in the PowerPoint file parser, which dereferences a pointer value derived from untrusted document data without validating that the pointer targets a legitimate object. When the parser follows this pointer, it reads memory at an attacker-influenced address and returns or reflects that data through application processing. Because the read occurs in the context of the user opening the file, any in-process memory can potentially be exposed, including secrets loaded by other Office components. The vulnerability is scored against a network attack vector because the malicious document can be delivered through email, web download, or shared collaboration platforms.

Root Cause

The root cause is an untrusted pointer dereference categorized under [CWE-822]. PowerPoint reads a value from a specially crafted structure inside the presentation file and treats that value as a valid memory pointer. No bounds or object-type validation is performed before the dereference, so an attacker who controls the file controls the address that PowerPoint reads.

Attack Vector

An attacker delivers a crafted .ppt, .pptx, or related PowerPoint file to a target user. Delivery paths include phishing email attachments, malicious links to SharePoint or OneDrive documents, and files staged on watering-hole sites. When the user opens the file in a vulnerable Office build, the parser triggers the untrusted pointer dereference and information from the PowerPoint process memory can be disclosed to the attacker. No authentication is required, and the attacker does not need existing access to the target system.

No verified proof-of-concept code is publicly available. See the Microsoft Security Update Guide for vendor technical details.

Detection Methods for CVE-2026-72956

Indicators of Compromise

Inbound email attachments containing PowerPoint files from untrusted or newly registered senders, especially with lure-style filenames.
PowerPoint (POWERPNT.EXE) processes making outbound network connections to previously unseen or low-reputation domains shortly after document open.
Unexpected child processes spawned by POWERPNT.EXE or abnormal loading of network libraries such as wininet.dll or winhttp.dll.

Detection Strategies

Deploy behavioral monitoring that correlates Office document open events with subsequent outbound network activity and memory access anomalies.
Enable Microsoft Defender Attack Surface Reduction (ASR) rules that block Office applications from creating child processes and from making outbound network calls when not required.
Hunt across endpoint telemetry for POWERPNT.EXE process trees that include network I/O to non-Microsoft destinations following the opening of externally sourced files.

Monitoring Recommendations

Ingest Office telemetry, Windows process creation (Event ID 4688), and Sysmon network events into a centralized analytics platform for correlation.
Alert on PowerPoint reading unusual file paths or accessing credential stores immediately after opening an email-delivered attachment.
Track EPSS trend data for CVE-2026-72956 to prioritize hunting as exploitation likelihood shifts.

How to Mitigate CVE-2026-72956

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all affected Office installations.
Prioritize patching for users who routinely handle externally sourced PowerPoint files, including sales, HR, and executive assistants.
Reinforce user awareness that PowerPoint files from unknown senders should be opened in Protected View or not at all.

Patch Information

Microsoft has released updates addressing CVE-2026-72956 for Microsoft 365 Apps, Office 2019, Office 2021 LTSC, and Office 2024 LTSC. Refer to the Microsoft Security Update Guide for the specific build numbers and channels applicable to each product. Click-to-Run installations of Microsoft 365 Apps should receive the fix automatically once the affected channel is updated; LTSC deployments require the corresponding MSI security update.

Workarounds

Enforce Protected View for all files originating from the internet and email attachments through Group Policy.
Block or quarantine inbound PowerPoint attachments from external senders at the email gateway until patching is complete.
Configure Office File Block policy to prevent opening legacy PowerPoint binary formats where not required for business.

bash

# Example: enforce Protected View via Group Policy registry keys (per-user)
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f