Microsoft Office PowerPoint: Information disclosure via out-of-bounds read
Summary
A out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network. The attacker needs a victim to take an action, typically opening a crafted presentation file, as the CVSS vector requires user interaction. The impact is limited to confidentiality; no integrity or availability impact is documented.
Affected
- Microsoft 365 Apps for Enterprise (16.0.1 before fixed build; exact build listed only via https://aka.ms/OfficeSecurityReleases)
- Microsoft Office 365 for Mac (1.0.0 before 16.115.26110837)
- Microsoft Office LTSC 2021 (16.0.1 before 16.0.14334.21048)
- Microsoft Office LTSC 2024 (16.0.0 before 16.0.17932.21140, unverified)
- Microsoft Office LTSC for Mac 2021 and 2024 (before 16.115.26110837)
Fixed in
- Microsoft 365 Apps for Enterprise: Unknown, check the Microsoft 365 release notes
- Microsoft Office 365 for Mac: 16.115.26110837
- Microsoft Office LTSC 2021: 16.0.14334.21048
- Microsoft Office LTSC 2024: 16.0.17932.21140 (unverified)
- Microsoft Office LTSC for Mac 2021 and 2024: 16.115.26110837
Workaround
Unknown. No specific mitigation has been published; installing the November 2026 Office updates is the remedy.
Exploitation
- Rapid7 rates exploitation as less likely, with no public disclosure.
- No CISA KEV listing, public proof of concept or GitHub advisory found.
- CISA SSVC: exploitation none, not automatable.
Our recommendation
- Apply the November 10, 2026 Microsoft 365 and Office updates to all Office clients, including Mac.
- Confirm the exact fixed build for Microsoft 365 Apps on the MSRC page.
- Remind users to be cautious with presentations from unknown senders or downloaded from the web.
- Re-check NVD and CISA KEV later, as the CVE was still awaiting analysis.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MSRC Security Update Guide: CVE-2026-112738 msrc.microsoft.com
- CVE Record CVE-2026-112738 www.cve.org
- Microsoft 365 Apps security updates learn.microsoft.com
- Rapid7 Patch Tuesday November 2026 www.rapid7.com
- BleepingComputer Patch Tuesday November 2026 www.bleepingcomputer.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 12:28.
Original description (NVD)
Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.