CVE-2026-88203: CWE-822: Untrusted Pointer Dereference in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-88203) is classified as CWE-822, an untrusted pointer dereference in Microsoft Office PowerPoint, part of Microsoft 365 Apps for Enterprise. It allows an unauthorized attacker to cause information disclosure remotely, requiring user interaction. The CVSS 3.1 base score is 6.5, reflecting a network attack vector with low attack complexity and no privileges required. The vulnerability affects versions =16.0.1, >=16.0.1 <16.0.14334.20974, and >=16.0.0 <16.0.17932.21056. Microsoft has published an official fix and manages remediation for this cloud-hosted service.

Successful exploitation can lead to unauthorized disclosure of information over a network without impacting integrity or availability. The attacker does not require privileges but does require user interaction. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the provided updates to affected versions of Microsoft 365 Apps for Enterprise as detailed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88203. Since this is a cloud service, Microsoft manages remediation server-side. No additional mitigation actions are specified.