high · CVSS v3 6.5
CVE-2026-108454
A buffer over-read vulnerability in Microsoft Office PowerPoint can lead to information disclosure over a network. The flaw allows an attack
Overview
A buffer over-read vulnerability in Microsoft Office PowerPoint can lead to information disclosure over a network. The flaw allows an attacker to read memory beyond intended bounds, potentially leaking sensitive data. It is rated high severity and requires immediate attention.
Description
Buffer over-read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
Impact
The vulnerability primarily compromises confidentiality by exposing sensitive data that may reside in memory. Integrity is not directly affected, but the leaked information could be used to facilitate further attacks. End users and organizations that rely on PowerPoint for document creation and sharing are the main stakeholders.
Remediation
Apply the latest Microsoft Office security updates that address CVE-2026-108454. Ensure all PowerPoint installations are up-to-date and consider disabling or restricting macro execution. Monitor network traffic for anomalous read patterns and implement application whitelisting to limit execution of untrusted PowerPoint files.
Risk context
High severity (CVSS 6.5) indicates a significant risk; organizations should prioritize patching and monitoring to mitigate potential data exposure.
Affected products
- Microsoft Office PowerPoint
Scores
- Severity
- high
- CVSS v2
- 7.8
- CVSS v3
- 6.5
- CVSS v4
- —
- EPSS
- —