CVE-2026-72977 in Office
Summary
by MITRE • 09/08/2026
Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as an out-of-bounds read within Microsoft Office PowerPoint represents a critical memory safety flaw that compromises the confidentiality of system data through remote exploitation vectors. This specific type of error occurs when software attempts to access memory locations beyond the boundaries of allocated buffers, often due to insufficient validation of input parameters or improper handling of malformed files. In the context of PowerPoint presentations, an attacker can craft a malicious file containing specially designed content that triggers this erroneous memory read operation during parsing or rendering processes. When triggered, the application does not simply crash but instead leaks sensitive information from adjacent memory regions back to the user interface or network stack, depending on how the vulnerability is exploited in conjunction with other techniques.
From a technical perspective, this flaw aligns closely with Common Weakness Enumeration category CWE-125, which describes out-of-bounds read vulnerabilities where data is accessed outside of buffer boundaries without proper bounds checking. The operational impact centers on information disclosure rather than immediate code execution or denial of service, although the latter may occur as a side effect if the application becomes unstable due to corrupted memory state. An unauthorized attacker leveraging this vulnerability can potentially extract sensitive data such as credentials stored in clipboard buffers, cached network tokens, or other private information residing in the process memory space. This capability allows for stealthy reconnaissance and credential harvesting without leaving obvious traces of system compromise, making it particularly dangerous in enterprise environments where PowerPoint is frequently used to share documents over email or file sharing services.
The exploitation pathway typically involves social engineering tactics combined with technical precision, as described by MITRE ATT&CK technique T1204, which covers user execution of malicious content. An adversary would distribute a crafted presentation file through phishing emails or compromised websites, relying on the victim to open it within Microsoft Office applications that are configured to automatically process embedded objects and media. Once opened, the parsing engine encounters the malformed data structure that causes the out-of-bounds read condition. The leaked memory contents can then be exfiltrated over the network if combined with additional exploit code or simply displayed in a way that allows visual extraction by the attacker. This scenario highlights the risk associated with default configurations that enable automatic content processing and macro execution, which reduce the friction for initial access stages of an attack chain.
Mitigation strategies must focus on both technical controls and user awareness to effectively counter this threat vector. Organizations should ensure that Microsoft Office applications are updated with the latest security patches released by vendor updates channels, as these typically include fixes for memory safety issues like out-of-bounds reads. Implementing application control policies using tools such as AppLocker or Windows Defender Application Control can restrict PowerPoint from executing untrusted scripts or loading unauthorized add-ins that might facilitate further exploitation steps. Additionally, configuring Office applications to disable automatic content processing and macros by default significantly reduces the attack surface for initial access attempts. User training programs should emphasize caution when opening documents received from unknown sources, particularly those with unexpected file extensions or embedded media elements. Network segmentation and monitoring solutions can also help detect anomalous outbound traffic patterns that may indicate successful data exfiltration following exploitation of this vulnerability.