CVE-2026-105599: Microsoft Office PowerPoint Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
Other sources
Microsoft Office PowerPoint Remote Code Execution Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.17932.21056 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in https://aka.ms/OfficeSecurityReleases - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.14334.20974
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The supplied CVSS vector indicates a network-based attack with no privileges required, but user interaction is required. Exploitation is rated high complexity.
What is the potential impact of successful exploitation?
Successful exploitation is rated high impact for confidentiality, integrity, and availability. The CVSS vector indicates the vulnerable component and impacted system are within the same security authority.
Is exploitation known to be available?
The supplied CVSS temporal metrics mark exploit code maturity as unproven. This does not rule out exploitation, but the provided data does not indicate a confirmed public exploit.