CVE-2026-78513: Microsoft Office PowerPoint Information Disclosure Vulnerability
Microsoft Office PowerPoint Information Disclosure Vulnerability
Other sources
Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.113.26091433 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.5569.1002Patch KB5002920 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.17932.20976 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.20326.20138 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.14334.20906 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.10417.20207
Event History
Frequently Asked Questions
What user interaction is required for exploitation?
The attack vector is local and user interaction is required. The provided data does not specify the exact interaction, such as opening or previewing a PowerPoint file.
Does exploitation require an authenticated account or other privileges?
No privileges are required according to the vector (PR:N). However, exploitation is limited to local access (AV:L).
What is the security impact if exploitation succeeds?
Successful exploitation can disclose information. The impact is limited to confidentiality (C:H); no integrity or availability impact is indicated.
Which PowerPoint deployments are identified as affected?
The listed affected software includes PowerPoint 2016, Microsoft 365 Apps for Enterprise, Microsoft PowerPoint, Office LTSC 2024 and 2021 for 32-bit editions, Office 365 for Mac, and Office LTSC for Mac 2024 and 2021.