CVE-2026-72977: Microsoft 365 Apps Information Disclosure

CVE-2026-72977 Overview

CVE-2026-72977 is an out-of-bounds read vulnerability in Microsoft Office PowerPoint that allows an unauthorized attacker to disclose information over a network. The flaw is classified under [CWE-20] Improper Input Validation and affects multiple supported Office releases across Windows and macOS. Exploitation requires user interaction, typically by opening a crafted PowerPoint file delivered through email, web download, or a shared document location. Successful exploitation exposes memory contents from the PowerPoint process, which can include sensitive document data, heap addresses, or other in-process information useful for further attacks.

Critical Impact
A remote attacker can trick a user into opening a malicious presentation to read out-of-bounds memory from the PowerPoint process, leading to disclosure of sensitive information.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft 365 for macOS, Microsoft Office 2019, Office 2021 LTSC, and Office 2024 LTSC (Windows and macOS)
Microsoft PowerPoint 2016 (x64 and x86)

Discovery Timeline

2026-09-08 - CVE-2026-72977 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-72977

Vulnerability Analysis

The vulnerability is an out-of-bounds read in the PowerPoint file parser. When PowerPoint processes a specially crafted presentation, it reads memory outside the bounds of an allocated buffer. The attacker does not gain code execution or the ability to modify data, but can retrieve the contents of adjacent memory. Impact is limited to confidentiality; integrity and availability are not affected. Exploitation is performed over a network vector because the malicious file is delivered remotely, though the read itself occurs on the victim host once the file is opened.

Root Cause

The underlying weakness is Improper Input Validation [CWE-20]. PowerPoint fails to properly validate a length, offset, or structure field within a presentation file before performing a read operation. Microsoft has not published parser-level technical detail; consult the Microsoft Security Update Guide for authoritative information.

Attack Vector

An attacker crafts a malicious .ppt, .pptx, or related PowerPoint file and delivers it to a target through phishing email, a link to attacker-controlled hosting, a compromised web page, or a shared collaboration platform. The user must open the file for the out-of-bounds read to occur. Disclosed memory can be exfiltrated through embedded content, telemetry channels, or subsequent user-driven actions inside the presentation.

No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-72977

Indicators of Compromise

PowerPoint files (.ppt, .pptx, .ppsx) delivered from untrusted senders or external file shares, particularly those flagged by mail gateways as containing malformed OOXML structures.
Unexpected outbound network connections from POWERPNT.EXE shortly after a document open event.
Crashes or abnormal termination of POWERPNT.EXE correlated with recently opened attachments.

Detection Strategies

Inspect email attachments and web downloads for malformed PowerPoint files using content-disarm-and-reconstruct or sandbox detonation before delivery to end users.
Correlate Office child process telemetry and file open events with subsequent outbound network activity from Office processes.
Alert on POWERPNT.EXE process crashes and Windows Error Reporting events that follow attachment open actions.

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction rules that block Office applications from creating child processes and from making network calls where feasible.
Ingest endpoint process, file, and network telemetry into a centralized data lake to hunt for anomalous PowerPoint behavior across the fleet.
Track patch compliance for all Office 2019, 2021 LTSC, 2024 LTSC, Microsoft 365 Apps, and PowerPoint 2016 installations, including macOS builds.

How to Mitigate CVE-2026-72977

Immediate Actions Required

Apply the Microsoft security updates referenced in the Microsoft Security Update Guide to all affected Office products on Windows and macOS.
Prioritize patching for endpoints handling external correspondence, including executive assistants, sales, HR, and finance users.
Block or quarantine inbound PowerPoint attachments from untrusted senders at the email gateway until patches are deployed.

Patch Information

Microsoft has released fixes through the standard Office update channels. Refer to the Microsoft Security Update Guide for the specific build numbers and Click-to-Run channel versions that remediate CVE-2026-72977 across Microsoft 365 Apps, Microsoft 365 for macOS, Office 2019, Office 2021 LTSC, Office 2024 LTSC, and PowerPoint 2016.

Workarounds

Open untrusted PowerPoint files in Protected View and do not enable editing unless the sender and content are verified.
Use Office File Block policy to prevent legacy binary PowerPoint formats from opening, or force them to open in Protected View only.
Train users to report unexpected presentations rather than opening them, and reinforce phishing awareness for attachment-based lures.

bash

# Example: enforce Protected View and File Block for PowerPoint via Group Policy registry keys
reg add "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\FileBlock" /v PPT97Files /t REG_DWORD /d 2 /f