CVE-2026-78513: CWE-125: Out-of-bounds Read in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-78513) involves an out-of-bounds read in Microsoft Office PowerPoint, part of Microsoft 365 Apps for Enterprise. The flaw permits an unauthorized attacker to disclose information locally by reading memory outside the intended bounds. The CVSS 3.1 vector indicates the attack requires local access with low complexity and no privileges, but user interaction is required. The impact is limited to confidentiality with no integrity or availability impact. Microsoft has issued an official fix for this vulnerability.

An attacker with local access and the ability to trick a user into interacting with a malicious file could exploit this vulnerability to disclose sensitive information from memory. There is no impact on integrity or availability. No known exploits are currently active in the wild.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for Microsoft 365 Apps for Enterprise as detailed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-78513. Since this is a local vulnerability requiring user interaction, applying the patch is the primary mitigation.