high · CVSS v3 6.5
CVE-2026-108455
Out-of-bounds read in Microsoft Office PowerPoint can allow an unauthorized attacker to read sensitive data over a network. The flaw exists
Overview
Out-of-bounds read in Microsoft Office PowerPoint can allow an unauthorized attacker to read sensitive data over a network. The flaw exists in the rendering engine and can be triggered by crafted presentation files. It poses a risk of confidential information leakage to external actors.
Description
Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
Impact
Confidentiality is compromised as attackers can read data from memory and transmit it over the network. Integrity and availability are not directly affected. The primary impact is on users and organizations that rely on PowerPoint for sensitive presentations.
Remediation
Apply the latest Microsoft Office security update that addresses CVE-2026-108455. Ensure that all Office installations are kept current via Windows Update or Office 365 update channels. Restrict network access to PowerPoint files from untrusted sources, use application whitelisting, and monitor for anomalous outbound traffic.
Risk context
High severity with a CVSS v3 score of 6.5 indicates a moderate to high risk. Organizations should prioritize patching and monitoring, as the vulnerability can be exploited remotely without authentication.
Affected products
- Microsoft Office PowerPoint
- Microsoft Office 365
- Microsoft Office 2021
- Microsoft Office 2019
- Microsoft Office 2016
- Microsoft Office for Mac
- Microsoft Office Online
- Microsoft Office 2024
Scores
- Severity
- high
- CVSS v2
- 7.8
- CVSS v3
- 6.5
- CVSS v4
- —
- EPSS
- —