CVE-2026-108454: Microsoft Office PowerPoint Information Disclosure Vulnerability
Buffer over-read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
Other sources
Microsoft Office PowerPoint Information Disclosure Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in https://aka.ms/OfficeSecurityReleases - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.17932.21056 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.114.26101123 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.14334.20974
Event History
Frequently Asked Questions
Which deployments are in scope?
The affected software list includes Microsoft 365 Apps for Enterprise; Microsoft Office LTSC 2021 and 2024 for 32-bit and 64-bit editions; Microsoft Office LTSC for Mac 2021 and 2024; and Microsoft Office 365 for Mac.
What does exploitation require?
The CVSS vector indicates network-reachable exploitation with low attack complexity and no attacker privileges required, but user interaction is required. Successful exploitation affects confidentiality, with no stated integrity or availability impact.