CVE-2026-97005: CWE-125: Out-of-bounds Read in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-97005) involves an out-of-bounds read in Microsoft Office PowerPoint, part of Microsoft 365 Apps for Enterprise. The flaw enables an unauthorized attacker to disclose information locally by reading memory outside the intended bounds. The CVSS 3.1 vector indicates local attack vector, low complexity, no privileges required, user interaction needed, and high confidentiality impact without integrity or availability impact. Microsoft has published an official fix for this vulnerability.

An attacker with local access and requiring user interaction can exploit this vulnerability to disclose sensitive information from memory. There is no impact on integrity or availability. No known exploits are reported in the wild at this time.

Microsoft has released an official fix for this vulnerability. Users and administrators should apply the provided security updates as detailed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97005 to remediate this issue.