CVE-2026-72956: CWE-822: Untrusted Pointer Dereference in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability, tracked as CVE-2026-72956 and classified under CWE-822 (Untrusted Pointer Dereference), affects Microsoft Office PowerPoint in Microsoft 365 Apps for Enterprise. It allows an unauthorized attacker to cause information disclosure over a network by exploiting improper handling of pointers. The CVSS 3.1 base score is 6.5, indicating medium severity, with an attack vector of network, low attack complexity, no privileges required, and user interaction required. The vulnerability does not impact integrity or availability but compromises confidentiality. Multiple affected version ranges are identified, and Microsoft has released an official fix. The vulnerability is documented in the Microsoft Security Response Center advisory.

An attacker who successfully exploits this vulnerability can disclose sensitive information over a network without requiring privileges but does require user interaction. The confidentiality of data is impacted, but integrity and availability remain unaffected. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for Microsoft 365 Apps for Enterprise as detailed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-72956. Since this is a cloud service, Microsoft manages remediation for the cloud-hosted components. No additional mitigation actions are indicated by the vendor advisory.