Description
Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.
Published: 2026-09-08
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Local Information Disclosure
Action: Apply Patch
AI Analysis

Impact

An out-of-bounds read in Microsoft Office PowerPoint allows an attacker with local access to read memory contents that are not intended for the process, potentially exposing sensitive data such as credentials, documents or system information. The flaw is classified as CWE‑125.

Affected Systems

Affected Microsoft Office products include Microsoft 365 Apps for Enterprise, Office 2019, Office 365 for Mac, Office LTSC 2021 and 2024, Office LTSC for Mac 2021 and 2024, and Microsoft PowerPoint 2016.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate risk. EPSS data is unavailable and the vulnerability is not listed in CISA KEV, implying no known widespread exploitation. The likely attack vector is local, requiring an attacker to have at least user-level access to a machine running a vulnerable Office version; elevated privileges would enable broader information disclosure.

Generated by OpenCVE AI on September 9, 2026 at 21:13 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Install the Microsoft Office update that addresses CVE‑2026‑78513 for all affected products.
  • Restrict local user accounts to the least privilege and implement application whitelisting for Microsoft PowerPoint to prevent unauthorized execution.
  • Ensure that no legacy Office installations remain on the network and conduct regular security audits to verify that all systems are up to date.

Generated by OpenCVE AI on September 9, 2026 at 21:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 09 Sep 2026 19:00:00 +0000

Type Values Removed Values Added
First Time appeared Microsoft microsoft 365
Microsoft powerpoint
CPEs cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*
cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*
cpe:2.3:a:microsoft:microsoft_365:-:*:*:*:*:macos:*:*
cpe:2.3:a:microsoft:office_2019:-:*:*:*:*:*:x64:*
cpe:2.3:a:microsoft:office_2019:-:*:*:*:*:*:x86:*
cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x64:*
cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x86:*
cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:macos:-:*
cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x64:*
cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x86:*
cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:macos:-:*
cpe:2.3:a:microsoft:powerpoint:2016:*:*:*:*:*:x64:*
cpe:2.3:a:microsoft:powerpoint:2016:*:*:*:*:*:x86:*
Vendors & Products Microsoft microsoft 365
Microsoft powerpoint

Tue, 08 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 08 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Description Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.
Title Microsoft Office PowerPoint Information Disclosure Vulnerability
First Time appeared Microsoft
Microsoft 365 Apps
Microsoft office 2019
Microsoft office 2021
Microsoft office 2024
Microsoft office 365
Microsoft office Macos 2021
Microsoft office Macos 2024
Microsoft powerpoint 2016
Weaknesses CWE-125
CPEs cpe:2.3:a:microsoft:365_apps:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:microsoft:office_2019:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:office_2021:*:*:*:*:long_term_servicing_channel:*:*:*
cpe:2.3:a:microsoft:office_2024:*:*:*:*:long_term_servicing_channel:*:*:*
cpe:2.3:a:microsoft:office_365:*:*:*:*:*:macos:*:*
cpe:2.3:a:microsoft:office_macos_2021:*:*:*:*:*:long_term_servicing_channel:*:*
cpe:2.3:a:microsoft:office_macos_2024:*:*:*:*:*:long_term_servicing_channel:*:*
cpe:2.3:a:microsoft:powerpoint_2016:*:*:*:*:*:*:*:*
Vendors & Products Microsoft
Microsoft 365 Apps
Microsoft office 2019
Microsoft office 2021
Microsoft office 2024
Microsoft office 365
Microsoft office Macos 2021
Microsoft office Macos 2024
Microsoft powerpoint 2016
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C'}

Subscriptions

Microsoft 365 Apps Microsoft 365 Office 2019 Office 2021 Office 2024 Office 365 Office Macos 2021 Office Macos 2024 Powerpoint Powerpoint 2016
cve-icon MITRE

Status: PUBLISHED

Assigner: microsoft

Published:

Updated: 2026-09-25T21:33:40.310Z

Reserved: 2026-08-24T17:28:00.622Z

Link: CVE-2026-78513

cve-icon Vulnrichment

Updated: 2026-09-08T20:19:45.533Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-08T18:20:46.590

Modified: 2026-09-17T20:18:31.927

Link: CVE-2026-78513

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-27T21:45:14Z

Weaknesses