CVE-2026-97744: Microsoft PowerPoint Information Disclosure

CVE-2026-97744 Overview

CVE-2026-97744 is an out-of-bounds read vulnerability in Microsoft Office PowerPoint that enables local information disclosure. An attacker can craft a malicious PowerPoint file that, when opened by a user, causes the application to read memory outside the intended buffer boundaries. The flaw is tracked under CWE-125: Out-of-bounds Read and requires user interaction to trigger.

Critical Impact
Successful exploitation leaks sensitive process memory contents from PowerPoint, potentially exposing data that can facilitate follow-on attacks.

Affected Products

Microsoft Office PowerPoint (see the Microsoft Security Update Guide for specific builds)
Microsoft 365 Apps distributions containing the affected PowerPoint component
Standalone Office installations with the vulnerable PowerPoint parser

Discovery Timeline

2026-10-13 - CVE-2026-97744 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-97744

Vulnerability Analysis

The vulnerability is an out-of-bounds read in the PowerPoint file parsing code path. When PowerPoint processes a specifically crafted presentation file, the application reads data from memory addresses beyond the intended buffer boundary. The read operation returns memory contents that were never meant to be exposed to the file-rendering logic.

Because the issue is a read primitive, it does not grant code execution or write access. The confidentiality impact is high while integrity and availability remain unaffected, consistent with a pure information disclosure primitive. Exploitation requires the user to open the malicious file, which is typical for Office document-based attacks delivered through phishing.

Root Cause

The underlying defect is classified as CWE-125: Out-of-bounds Read. PowerPoint's parser does not sufficiently validate size or offset fields in a structure before dereferencing them. A crafted record with manipulated length values causes the parser to read past the end of an allocated buffer. The exposed bytes may include heap metadata, pointers useful for ASLR bypass, or fragments of previously processed documents.

Attack Vector

The attack requires local file processing and user interaction. An attacker delivers a weaponized .pptx, .ppt, or related PowerPoint file through email, a shared drive, or a web download. When the victim opens the file, PowerPoint parses the malformed record and leaks memory contents. The attacker typically exfiltrates the leaked data through external content references, OLE objects, or macro-driven channels embedded in the same document.

No verified public exploit code is available for CVE-2026-97744 at this time. Technical details are published in the Microsoft Security Update Guide.

Detection Methods for CVE-2026-97744

Indicators of Compromise

PowerPoint files received from untrusted sources containing malformed OOXML records or unusually structured binary streams
POWERPNT.EXE processes crashing or generating Windows Error Reporting events shortly after opening a document
Outbound network connections initiated by POWERPNT.EXE to attacker-controlled hosts immediately after document open

Detection Strategies

Inspect inbound email attachments and file shares for PowerPoint documents with anomalous record sizes or embedded external references
Hunt for POWERPNT.EXE spawning unexpected child processes or performing non-standard file reads following document open events
Correlate Office telemetry with endpoint behavioral alerts to identify memory access anomalies during presentation rendering

Monitoring Recommendations

Enable Microsoft Office audit logging and forward events to a centralized SIEM for retention and correlation
Monitor for Protected View bypass attempts and documents that disable Mark-of-the-Web enforcement
Track user-reported document crashes in PowerPoint as potential exploitation signals

How to Mitigate CVE-2026-97744

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide as soon as it is available in your patch cycle
Enforce Protected View for files originating from the internet, email attachments, and unsafe locations
Block or quarantine PowerPoint attachments from untrusted senders at the email gateway

Patch Information

Microsoft has published the fix through the Microsoft Security Update Guide. Administrators should deploy the update via Windows Update, Microsoft Update, Microsoft 365 Apps update channels, or WSUS/Intune depending on the deployment model. Verify installation on all endpoints running PowerPoint, including shared workstations and virtual desktop infrastructure images.

Workarounds

Enable Protected View and Application Guard for Office to isolate untrusted documents from host memory
Configure Attack Surface Reduction (ASR) rules to block Office child process creation and credential theft behaviors
Restrict PowerPoint from opening files downloaded with Mark-of-the-Web unless explicitly approved by the user
Deliver user awareness guidance to avoid opening unsolicited .ppt and .pptx attachments

bash

# Configuration example: enforce Protected View via Group Policy registry keys
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f