CVE-2026-97744: CWE-125: Out-of-bounds Read in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-97744) involves an out-of-bounds read in Microsoft Office PowerPoint, part of Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker to locally disclose information by reading memory outside the intended bounds. The CVSS 3.1 vector indicates the attack requires local access with low complexity and no privileges but requires user interaction. The impact is confidentiality loss without integrity or availability impact. Microsoft has published an official fix and manages remediation for this cloud service. No active exploitation has been reported.

An unauthorized local attacker can exploit this vulnerability to disclose sensitive information from memory. The impact is limited to confidentiality loss; there is no impact on integrity or availability. The attack requires local access and user interaction, reducing the likelihood of remote exploitation.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should apply the official updates as directed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97744 to mitigate this vulnerability.