CVE-2026-72975: CWE-125: Out-of-bounds Read in Microsoft Microsoft 365 Apps for Enterprise

CVE-2026-72975 is a security vulnerability classified as CWE-125 (Out-of-bounds Read) affecting Microsoft Office PowerPoint in Microsoft 365 Apps for Enterprise. The vulnerability allows an unauthorized attacker to read memory outside the intended bounds, potentially disclosing sensitive information over a network. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges but requires user interaction. Microsoft has published an official fix addressing this issue. The affected versions span multiple version ranges prior to fixed builds in the 16.x and 19.x branches of the product.

An attacker can exploit this vulnerability to disclose sensitive information from memory remotely without requiring privileges, but user interaction is necessary. The confidentiality impact is high, while integrity and availability impacts are not affected. No known active exploitation has been reported.

Microsoft has released an official fix for this vulnerability. Users and administrators should apply the latest updates for Microsoft 365 Apps for Enterprise as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-72975. Since this is a cloud service, Microsoft manages remediation for the cloud-hosted components. No additional mitigation steps are required beyond applying the official update.