Microsoft Office PowerPoint: Information disclosure through type confusion
Summary
A type confusion flaw (CWE-843) in Microsoft Office PowerPoint allows an unauthenticated attacker to disclose information over a network. The record rates it CVSS 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N): integrity and availability are not affected. Exploitation requires a user to open a crafted file, so the main exposure is through email and file sharing.
Affected
- Microsoft 365 Apps for Enterprise: 16.0.1 before the fixed build listed at https://aka.ms/OfficeSecurityReleases\n- Office LTSC 2021: before 16.0.14334.21048\n- Office LTSC 2024: before 16.0.17932.21140\n- Office for Mac 2021 and LTSC for Mac 2024: before 16.115.26110837\n- Office 365 for Mac: before 16.115.26110837 (lower bound of the affected range is inconsistent between sources)
Fixed in
- Microsoft 365 Apps for Enterprise: Unknown (check the Microsoft release notes)\n- Office LTSC 2021: 16.0.14334.21048\n- Office LTSC 2024: 16.0.17932.21140\n- Office for Mac: 16.115.26110837 (to be verified against MSRC)\n- Microsoft released the fixes with the Office security updates of November 10, 2026.
Workaround
- Unknown. No vendor workaround is named in the sources.\n- Keep Protected View and file-block policies enabled for files from the internet and from email.
Exploitation
- Not known to be exploited in the wild.\n- No public proof-of-concept found.\n- Rapid7 rates exploitation as less likely. CISA SSVC: exploitation none, not automatable.
Our recommendation
- Install the November 2026 Office security updates on all affected Microsoft 365, LTSC and Mac installations.\n- Verify the installed build against the Microsoft Security Update Guide, especially for Microsoft 365 Apps where the fixed build is not confirmed.\n- Keep Protected View and file-block policies active and be careful with PowerPoint files received from outside the company.\n- Prioritise this update in the normal Office patch cycle (medium priority).
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-116922 msrc.microsoft.com
- CVE Record CVE-2026-116922 www.cve.org
- Microsoft 365 Apps security updates learn.microsoft.com
- Rapid7 Patch Tuesday November 2026 www.rapid7.com
- GBHackers: Microsoft November 2026 Patch Tuesday gbhackers.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 12:16.
Original description (NVD)
Access of resource using incompatible type ('type confusion') in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.