CVE-2026-78513: Microsoft 365 Apps Information Disclosure

CVE-2026-78513 Overview

CVE-2026-78513 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Office PowerPoint. An unauthorized attacker can leverage the flaw to disclose information locally when a user opens a crafted PowerPoint file. Exploitation requires user interaction but no authentication. The vulnerability affects multiple Microsoft Office product lines across Windows and macOS platforms, including Microsoft 365 Apps, Office 2019, Office 2021, Office 2024, and PowerPoint 2016.

Critical Impact
Successful exploitation exposes sensitive process memory contents to attackers, which may include credentials, cryptographic keys, or fragments of other opened documents that facilitate follow-on attacks.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft 365 for macOS
Microsoft Office 2019, 2021 (LTSC), and 2024 (LTSC) for Windows and macOS
Microsoft PowerPoint 2016 (x64 and x86)

Discovery Timeline

2026-09-08 - CVE-2026-78513 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-78513

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] in Microsoft Office PowerPoint parsing routines. When PowerPoint processes a malformed presentation file, the application reads memory beyond the intended buffer boundary. The exposed memory content can then be extracted by the attacker's crafted document logic or observed through subsequent application behavior.

The flaw is a confidentiality issue only. It does not modify data or affect application availability, and it does not permit code execution on its own. However, information leaked from process memory frequently serves as a primitive for chaining with memory-corruption bugs to defeat address space layout randomization (ASLR) or extract sensitive material.

With an EPSS score of 0.541%, in-the-wild exploitation is not currently predicted, and no public proof-of-concept is available.

Root Cause

The root cause is missing or incorrect bounds validation when parsing an element within the PowerPoint file format. Malformed size fields, offsets, or record lengths cause the parser to read past the end of an allocated structure. The affected code paths process attacker-controlled binary data before validating buffer boundaries.

Attack Vector

Exploitation requires local access and user interaction. An attacker delivers a crafted .ppt or .pptx file through email, a file share, a compromised website, or a collaboration platform. When the victim opens the file in a vulnerable PowerPoint version, the parser triggers the out-of-bounds read and leaks memory to attacker-controlled structures embedded in the document.

The vulnerability manifests during document parsing. Refer to the Microsoft Vulnerability Update CVE-2026-78513 advisory for vendor technical details.

Detection Methods for CVE-2026-78513

Indicators of Compromise

PowerPoint files (.ppt, .pptx, .ppsx) received from untrusted senders or downloaded from unverified sources
POWERPNT.EXE processes exhibiting unexpected crashes, memory access violations, or Windows Error Reporting (WerFault.exe) events shortly after opening a document
Outbound network connections initiated by POWERPNT.EXE to attacker-controlled infrastructure following document open
Office documents containing malformed OLE or Office Open XML structures flagged by mail gateway inspection

Detection Strategies

Deploy behavioral monitoring on POWERPNT.EXE for anomalous child process creation, memory read patterns, and outbound connections
Enable Microsoft Defender Attack Surface Reduction (ASR) rules that block Office applications from spawning child processes or making unusual network calls
Inspect inbound email attachments and file share uploads for malformed PowerPoint structures using content disarm and reconstruction tools

Monitoring Recommendations

Forward Windows Event Log entries for Office application crashes to a centralized SIEM for correlation
Track document provenance using Mark-of-the-Web (MOTW) attributes and alert when Protected View is bypassed for external files
Monitor endpoint telemetry for patterns of a single user opening multiple crafted documents in rapid succession, which may indicate targeted reconnaissance

How to Mitigate CVE-2026-78513

Immediate Actions Required

Apply the security update referenced in the Microsoft Vulnerability Update CVE-2026-78513 advisory across all affected Office installations
Prioritize patching endpoints that regularly process externally sourced PowerPoint files, including sales, marketing, and executive workstations
Verify that Microsoft 365 Apps update channels are configured to receive current builds and that Office 2019, 2021, and 2024 installations have received the corresponding cumulative update

Patch Information

Microsoft has released updates addressing CVE-2026-78513 for all affected products. Administrators should consult the Microsoft Security Response Center advisory for the specific build numbers, KB article identifiers, and macOS package versions that remediate the vulnerability.

Workarounds

Enforce Protected View for all files originating from the Internet, Outlook attachments, and unsafe locations through Group Policy
Block or quarantine PowerPoint file types at the email gateway when originating from external senders and when user business need does not require them
Enable Office File Block policy to restrict opening of legacy PowerPoint binary formats (.ppt, .pps) if not required for business operations
Train users to avoid opening unsolicited PowerPoint attachments and to report suspicious documents to the security team

bash

# Configuration example: enforce Protected View via Group Policy registry keys
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f