CVE-2026-88183: CWE-125: Out-of-bounds Read in Microsoft Microsoft 365 Apps for Enterprise

CVE-2026-88183 is a security vulnerability classified as CWE-125 (Out-of-bounds Read) in Microsoft Office PowerPoint, part of Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker to read memory outside the intended bounds, potentially disclosing sensitive information over a network. The vulnerability has been assigned a CVSS 3.1 base score of 6.5, indicating medium severity. Microsoft has published an official fix for this issue and manages remediation for this cloud-hosted service. The affected versions include =16.0.1, =1.0.0, >=16.0.1 <16.0.14334.20974, >=16.0.0 <16.0.17932.21056, and =16.0.0.

An attacker exploiting this vulnerability can cause an out-of-bounds read in Microsoft PowerPoint, leading to unauthorized disclosure of information over a network. There is no indication of integrity or availability impact. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the provided patches as per the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88183. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Verify that your environment is updated to a fixed version to mitigate this vulnerability.