CVE-2026-97005 Overview
CVE-2026-97005 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Office PowerPoint. The flaw allows an unauthorized attacker to disclose information locally when a user opens a crafted file. Exploitation requires user interaction, typically opening a malicious PowerPoint document delivered via phishing or file-sharing channels. Successful exploitation can leak sensitive memory contents from the PowerPoint process, including data that may aid follow-on attacks against the host.
Critical Impact
An attacker who tricks a user into opening a malicious PowerPoint file can read memory outside the intended buffer, exposing confidential in-process data.
Affected Products
- Microsoft Office PowerPoint (see the Microsoft CVE-2026-97005 Advisory for the authoritative list of affected builds)
Discovery Timeline
- 2026-10-13 - CVE CVE-2026-97005 published to NVD
- 2026-10-13 - Last updated in NVD database
Technical Details for CVE-2026-97005
Vulnerability Analysis
The issue is an out-of-bounds read inside Microsoft Office PowerPoint's file parsing logic. When PowerPoint processes a specially crafted presentation, the application reads memory beyond the bounds of an allocated buffer. The read operation returns adjacent process memory, which the attacker can harvest for sensitive content.
The vulnerability affects local confidentiality only. It does not provide integrity or availability impact on its own. Attackers commonly chain information disclosure flaws like this one with memory corruption bugs to defeat Address Space Layout Randomization (ASLR) during exploitation.
Root Cause
The root cause is improper validation of a length or offset field during the parsing of PowerPoint document structures. The parser trusts attacker-controlled size data and reads past the end of the allocated buffer, matching the [CWE-125] weakness pattern.
Attack Vector
Exploitation requires the attacker to deliver a crafted .ppt, .pptx, or related Office file to a victim. The victim must open the file for the vulnerable code path to execute. The attack is local in scope and does not require authentication on the target system. Phishing emails with malicious attachments and watering-hole file hosting are the most likely delivery channels.
No public proof-of-concept or in-the-wild exploitation has been reported at the time of publication. Refer to the Microsoft CVE-2026-97005 Advisory for technical details.
Detection Methods for CVE-2026-97005
Indicators of Compromise
- PowerPoint files received from untrusted sources that trigger crashes or abnormal POWERPNT.EXE process behavior on open.
- Unexpected child processes or outbound network connections spawned by POWERPNT.EXE shortly after document opening.
- Office telemetry entries showing repeated document parsing errors or exceptions in Office binaries.
Detection Strategies
- Inspect email gateways and file-sharing platforms for PowerPoint attachments from external or low-reputation senders.
- Enable Microsoft Office cloud-delivered protection and attack surface reduction (ASR) rules that block Office from spawning child processes.
- Correlate endpoint telemetry for POWERPNT.EXE memory access violations with recent document opens.
Monitoring Recommendations
- Monitor Windows Event Logs and EDR telemetry for Office application crashes, including Watson or Application Error events referencing POWERPNT.EXE.
- Track user-reported suspicious attachments and route them to the SOC for sandbox detonation.
- Alert on unusual file reads from the PowerPoint process memory space, especially when followed by data staging or exfiltration activity.
How to Mitigate CVE-2026-97005
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft CVE-2026-97005 Advisory as soon as it is available for your Office channel.
- Instruct users to avoid opening unsolicited PowerPoint attachments and to report suspicious files to the security team.
- Prioritize patching on systems used by high-value targets such as executives, finance, and IT administrators.
Patch Information
Microsoft has published guidance for CVE-2026-97005 through the Microsoft Security Response Center. Review the Microsoft CVE-2026-97005 Advisory for affected versions, update packages, and deployment instructions across Click-to-Run and MSI installations.
Workarounds
- Enable Protected View for files originating from the internet so that PowerPoint opens untrusted documents in a sandboxed, read-only mode.
- Configure Office File Block policy to prevent PowerPoint from opening legacy file formats from untrusted locations.
- Use attack surface reduction rules to block Office applications from creating executable content and child processes.
# Example: Enable Protected View for internet-sourced files via Group Policy registry keys
reg add "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.