CVE-2026-72975 Overview
CVE-2026-72975 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Office PowerPoint. An unauthorized attacker can disclose information over a network by convincing a user to open a crafted PowerPoint file. The flaw affects multiple Microsoft Office builds across Windows and macOS, including Microsoft 365 Apps, Office 2019, Office 2021, Office 2024, and PowerPoint 2016.
Exploitation requires user interaction but no privileges. The vulnerability can leak process memory contents that may include sensitive data such as authentication material or in-memory document data.
Critical Impact
A single crafted .pptx or .ppt file opened by a user can expose memory contents from the PowerPoint process to a remote attacker.
Affected Products
- Microsoft 365 Apps (Enterprise, x64 and x86)
- Microsoft 365 for macOS
- Microsoft Office 2019, Office 2021 LTSC, and Office 2024 LTSC (Windows and macOS)
- Microsoft PowerPoint 2016 (x64 and x86)
Discovery Timeline
- 2026-09-08 - CVE-2026-72975 published to the National Vulnerability Database
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-72975
Vulnerability Analysis
The vulnerability is an out-of-bounds read in Microsoft Office PowerPoint's file parsing logic. When PowerPoint processes a malformed presentation file, it reads memory beyond the intended buffer boundary. The read data is not written back to disk but can be reflected to the attacker through the parsing flow, leaking process memory.
The impact is limited to confidentiality. The vulnerability does not allow modification of data or interruption of service on its own. However, leaked memory can include heap metadata, pointer values useful for bypassing address space layout randomization (ASLR), or fragments of previously opened documents.
The issue is tracked under CWE-125: Out-of-bounds Read. Refer to the Microsoft Security Update Guide for vendor-specific technical notes.
Root Cause
The root cause is missing or incorrect bounds validation when PowerPoint parses a structured element within a presentation file. A crafted length or offset field in the file causes the parser to index outside the allocated buffer during a read operation.
Attack Vector
The attack vector is network-based but requires user interaction. An attacker delivers a malicious PowerPoint file through email, a shared link, a cloud storage service, or a compromised website. When the target opens or previews the file, PowerPoint parses the crafted structure and returns adjacent memory content to logic controlled by the attacker's payload. No authentication or elevated privileges are needed. The EPSS score at publication was 0.692%.
Detection Methods for CVE-2026-72975
Indicators of Compromise
- Inbound .pptx, .ppt, .pptm, or .ppsx attachments from untrusted senders that trigger anomalous PowerPoint child process activity.
- PowerPoint (POWERPNT.EXE) generating outbound network connections shortly after opening a file, particularly to uncategorized or newly registered domains.
- Crash dumps or Windows Error Reporting events from POWERPNT.EXE referencing access violations in file parsing modules.
Detection Strategies
- Inspect email gateways and web proxies for PowerPoint files carrying malformed OOXML parts or unusual embedded objects.
- Correlate Office telemetry with endpoint process events to identify presentations that spawn scripting hosts or make outbound requests.
- Hunt for exfiltration patterns where PowerPoint sessions initiate HTTP(S) or SMB traffic to attacker-controlled infrastructure after document open events.
Monitoring Recommendations
- Enable Microsoft Office cloud policy telemetry and forward Office alerts to your SIEM for behavioral analysis.
- Monitor Protected View bypass events and Mark-of-the-Web removal on inbound presentation files.
- Track patch compliance for all Office channels including Microsoft 365 Apps, LTSC editions, and macOS builds.
How to Mitigate CVE-2026-72975
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Security Update Guide for CVE-2026-72975 to all affected Office installations.
- Prioritize patching of user workstations that handle external presentation files, including executive assistants, sales teams, and finance staff.
- Enforce Protected View for files originating from the internet and from Outlook attachments.
Patch Information
Microsoft has published fixed builds through the Microsoft Update channel. Consult the Microsoft Security Update Guide for exact build numbers per channel (Current Channel, Monthly Enterprise Channel, Semi-Annual Enterprise Channel, LTSC, and macOS).
Workarounds
- Block or quarantine PowerPoint attachments from external senders at the email gateway until patches are deployed.
- Configure Attack Surface Reduction rules in Microsoft Defender to block Office applications from creating child processes and from making network calls where feasible.
- Instruct users to open untrusted presentations in PowerPoint for the web, which is not affected by the client parser flaw.
# Verify Microsoft 365 Apps build version on Windows
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /update user
# Force update check
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /update user updatepromptuser=true
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
