CVE-2026-72977: CWE-125: Out-of-bounds Read in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-72977) involves an out-of-bounds read in Microsoft Office PowerPoint, part of Microsoft 365 Apps for Enterprise. An attacker who successfully exploits this vulnerability could cause information disclosure over a network without requiring privileges but with user interaction. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, no integrity or availability impact, and official remediation is available. Multiple version ranges of Microsoft 365 Apps for Enterprise are affected, all fixed by official patches.

An attacker can exploit this vulnerability to read memory outside the intended bounds, potentially disclosing sensitive information over a network. The confidentiality impact is high, but integrity and availability are not affected. Exploitation requires user interaction but no privileges. There are no known active exploits in the wild.

Microsoft has released official patches to address this vulnerability. Users and administrators should apply the updates provided by Microsoft for Microsoft 365 Apps for Enterprise to remediate this issue. Since this is a cloud service, Microsoft manages remediation for the cloud-hosted components. Refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-72977 for detailed update instructions.