CVE-2026-108453
published 2026-10-15CVE-2026-108453: Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
PriorityP337medium6.5CVSS 3.1
AVNACLPRNUIRSUCHINAN
EPSS
0.51%
42.9th percentile
Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | microsoft_365_apps_for_enterprise | >= 16.0.1 < https://aka.ms/OfficeSecurityReleases | https://aka.ms/OfficeSecurityReleases |
| microsoft | microsoft_office_365_for_mac | >= 1.0.0 < 16.114.26101123 | 16.114.26101123 |
| microsoft | microsoft_office_ltsc_2021 | >= 16.0.1 < 16.0.14334.20974 | 16.0.14334.20974 |
| microsoft | microsoft_office_ltsc_2024 | >= 16.0.0 < 16.0.17932.21056 | 16.0.17932.21056 |
| microsoft | microsoft_office_ltsc_for_mac_2021 | >= 16.0.1 < 16.114.26101123 | 16.114.26101123 |
| microsoft | microsoft_office_ltsc_for_mac_2024 | >= 16.0.0 < 16.114.26101123 | 16.114.26101123 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Microsoft Office PowerPoint Information Disclosure Vulnerability
ghsa_unreviewed·2026-10-15
CVE-2026-108453 [MEDIUM] CWE-125 Microsoft Office PowerPoint Information Disclosure Vulnerability
Microsoft Office PowerPoint Information Disclosure Vulnerability
VulDB
Microsoft Office PowerPoint up to Office 365 for Mac information disclosure
vuldb·2026-10-15·CVSS 6.5
CVE-2026-108453 [MEDIUM] Microsoft Office PowerPoint up to Office 365 for Mac information disclosure
A vulnerability, which was classified as problematic, was found in Microsoft Office PowerPoint. Affected by this vulnerability is an unknown functionality. Such manipulation leads to information disclosure.
This vulnerability is documented as CVE-2026-108453. The attack can be executed remotely. There is not any exploit available.
It is best practice to apply a patch to resolve this issue.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-10-15
Published