CVE-2026-80086: Microsoft 365 Apps Information Disclosure

CVE-2026-80086 Overview

CVE-2026-80086 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Office PowerPoint. An unauthorized attacker can disclose information over a network by delivering a crafted PowerPoint file to a target user. Successful exploitation requires user interaction, typically opening the malicious document in a vulnerable version of PowerPoint. The flaw affects Microsoft 365 Apps, Microsoft 365 for macOS, and Office 2019, 2021, and 2024 across Windows and macOS platforms.

Critical Impact
A crafted PowerPoint document can cause PowerPoint to read memory beyond an allocated buffer, exposing sensitive process memory to an attacker over the network.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft 365 for macOS
Microsoft Office 2019, Office 2021 LTSC, and Office 2024 LTSC (Windows x64/x86 and macOS)

Discovery Timeline

2026-09-08 - CVE-2026-80086 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-80086

Vulnerability Analysis

The vulnerability is an out-of-bounds read in Microsoft Office PowerPoint. When PowerPoint parses a specially crafted presentation file, it reads data past the end of an allocated memory buffer. The disclosed memory may contain sensitive process data such as pointers, heap contents, or fragments of previously opened documents. An attacker cannot modify data or execute code through this flaw alone, but the leaked information can support follow-on attacks that require knowledge of memory layout.

The issue is network-exploitable because attackers can host or email the malicious file. However, exploitation requires the target user to open the crafted document, so social engineering is a prerequisite for successful attacks.

Root Cause

The root cause is missing or incorrect bounds validation when PowerPoint parses a structured element inside a presentation file. The parser trusts a length or offset field derived from attacker-controlled content and reads memory outside the intended buffer. This class of defect is tracked as CWE-125: Out-of-bounds Read.

Attack Vector

An attacker crafts a malicious .pptx or related PowerPoint file and delivers it through email, a web download, a collaboration platform, or a file share. When the victim opens the file in a vulnerable version of PowerPoint, the parser triggers the out-of-bounds read. The attacker recovers leaked memory contents through embedded external references, telemetry channels, or by convincing the victim to return rendered output. See the Microsoft CVE-2026-80086 Update Guide for vendor-supplied technical details.

Detection Methods for CVE-2026-80086

Indicators of Compromise

Inbound email attachments or download activity delivering PowerPoint files (.pptx, .ppt, .ppsx) from untrusted or newly observed senders.
PowerPoint (POWERPNT.EXE) processes making outbound network connections shortly after opening a document, especially to unfamiliar domains.
Crash telemetry or Windows Error Reporting entries referencing PowerPoint access violations tied to file parsing.

Detection Strategies

Inspect Office documents at the mail gateway and web proxy for anomalous structures, malformed OOXML parts, or oversized length fields.
Alert on child processes or network calls spawned by POWERPNT.EXE that deviate from a baseline of normal document activity.
Correlate document open events with subsequent outbound HTTP(S) requests to catch data exfiltration paths tied to leaked memory.

Monitoring Recommendations

Ingest Microsoft Office telemetry, endpoint process events, and email gateway logs into a centralized analytics platform for cross-source correlation.
Monitor for repeated PowerPoint crashes across multiple users, which can indicate active exploitation attempts of the same crafted payload.
Track Office version and patch state across the fleet so unpatched hosts opening external presentations can be prioritized for review.

How to Mitigate CVE-2026-80086

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-80086 Update Guide to all affected Office installations.
Prioritize patching for users who routinely handle presentations from external senders, including executives, sales, and finance.
Enable Protected View and Office Application Guard so untrusted documents open in an isolated sandbox by default.

Patch Information

Microsoft has released updates for Microsoft 365 Apps, Microsoft 365 for macOS, Office 2019, Office 2021 LTSC, and Office 2024 LTSC. Consult the Microsoft CVE-2026-80086 Update Guide for build numbers and deployment channels applicable to each product.

Workarounds

Block or quarantine PowerPoint attachments from untrusted external senders at the mail gateway until patches are deployed.
Enforce Office macro and external content restrictions through Group Policy to reduce the attack surface of malicious presentations.
Educate users to preview presentations in Protected View and to avoid disabling editing on files from unknown sources.

bash

# Configuration example: enforce Protected View for Office files from the Internet via Group Policy registry keys
reg add "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f