Microsoft Office PowerPoint Out-of-Bounds Read Information Disclosure

CVE-2026-87886 is an out-of-bounds read (CWE-125) in Microsoft Office PowerPoint's file-parsing logic. When a user opens — or even previews in the Preview Pane — a specially crafted .pptx file, PowerPoint reads past the intended buffer boundary and may expose fragments of heap memory to the attacker. The flaw affects Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021, Office LTSC 2024, Office 365 for Mac, and PowerPoint 2016. It was patched in the September 2026 Patch Tuesday release. The impact is strictly information disclosure — there is no code execution, no privilege escalation, and no denial of service.

The likely CVSS baseline for this class of PowerPoint OOB-read bug is around 6.5 (MEDIUM) based on the identical sibling CVEs published the same day (CVE-2026-80086, CVE-2026-72977, CVE-2026-72975). That score is generous for a vuln that requires user interaction, yields only partial heap contents, and has zero integrity or availability impact. In a fleet of 10,000 managed endpoints with email gateway filtering and user-awareness training, the practical risk drops further. noisgate reassesses this at 5.5 MEDIUM — it belongs in your regular patch cycle, not your war room.

Why this verdict

• Impact ceiling is info-disclosure only. No code execution, no integrity impact, no availability impact. The attacker gets fragments of heap memory — not a shell, not credentials with any reliability, not persistence.
• User interaction required. The victim must open or preview a malicious file. Protected View is enabled by default for external files, adding a second click-through gate. This is a compounding friction point that drops real-world exploitability.
• No exploitation evidence or PoC. Zero KEV listing, no known campaigns, no public exploit code, EPSS under 1%. The threat is entirely theoretical as of September 2026.
• Role multiplier: negligible. PowerPoint is a workstation productivity application. It does not run on domain controllers, hypervisors, CI/CD servers, or network edge appliances. The blast radius of a successful exploit is confined to partial heap disclosure on a single endpoint — no fleet-scale, identity-scale, or supply-chain impact path exists.

Why not higher?

There is no code execution, no privilege escalation, and no lateral movement capability in this vulnerability. The leaked data is random heap fragments with no guarantee of containing secrets. PowerPoint is not a high-value-role component — it runs on end-user workstations, not infrastructure. Without a PoC, active exploitation, or KEV listing, there is no basis for HIGH.

Why not lower?

The network attack vector with no authentication requirement means any external attacker can attempt delivery via email. The Preview Pane attack surface means user interaction can be as minimal as selecting the file in Explorer. Confidentiality impact is rated High in the CVSS vector because the OOB read *can* expose sensitive heap data. This is not ignorable — it belongs in the regular patch cycle.

1. Ensure Protected View is enforced for all external Office files — Protected View sandboxes the file parse and blocks external data connections, neutralizing the exfiltration channel. Verify via GPO: User Configuration > Administrative Templates > Microsoft PowerPoint > Security > Trust Center > Protected View. No mitigation SLA applies at MEDIUM — go straight to the 365-day remediation window.
2. Enable Attack Surface Reduction (ASR) rules for Office applications — ASR rule 'Block Office applications from creating child processes' (D4F940AB-401B-4EFC-AADC-AD5F3C50688A) and 'Block Office applications from creating executable content' limit post-exploitation pivots. Deploy via Intune or GPO.
3. Deploy Content Disarm and Reconstruction (CDR) on email gateway — CDR strips and rebuilds Office file structures, neutralizing malformed records that trigger OOB reads. Products like Votiro, Deep Secure, or Glasswall provide this capability.
4. Block .pptx attachments from untrusted external senders if feasible — If your organization rarely receives external PowerPoint files, a transport rule blocking or quarantining .pptx/.pptm from outside the org eliminates the delivery vector entirely.

Run on each target Windows host with PowerPoint installed. Execute in an elevated PowerShell session: powershell -ExecutionPolicy Bypass -File .\Check-CVE-2026-87886.ps1. No network access required — it checks local Office installation version against known patched builds.

#!/usr/bin/env pwsh
# Check-CVE-2026-87886.ps1
# Checks if Microsoft Office PowerPoint is patched for CVE-2026-87886
# (September 2026 Patch Tuesday OOB-read info disclosure)
# Run locally on target host. Requires read access to registry and filesystem.

$ErrorActionPreference = 'Stop'
$exitCode = 2  # UNKNOWN default

try {
    # Locate PowerPoint executable
    $pptPaths = @(
        "$env:ProgramFiles\Microsoft Office\root\Office16\POWERPNT.EXE",
        "${env:ProgramFiles(x86)}\Microsoft Office\root\Office16\POWERPNT.EXE",
        "$env:ProgramFiles\Microsoft Office\Office16\POWERPNT.EXE",
        "${env:ProgramFiles(x86)}\Microsoft Office\Office16\POWERPNT.EXE"
    )

    $pptExe = $null
    foreach ($p in $pptPaths) {
        if (Test-Path $p) { $pptExe = $p; break }
    }

    if (-not $pptExe) {
        Write-Host 'UNKNOWN - PowerPoint not found on this host.'
        exit 2
    }

    $ver = (Get-Item $pptExe).VersionInfo.FileVersion
    Write-Host "Detected PowerPoint version: $ver"

    # Parse version components
    $parts = $ver.Split('.')
    $major = [int]$parts[0]
    $minor = [int]$parts[1]
    $build = [int]$parts[2]
    $rev   = [int]$parts[3]

    # September 2026 Patch Tuesday for Office 16.0 (M365/2019/2021/2024)
    # Current Channel: 16.0.20000+ builds from Sept 2026
    # The exact patched build varies by channel. Use build 20009 as approximate threshold.
    # Adjust this threshold when Microsoft publishes exact build numbers.
    $patchedBuild = 20009
    $patchedRev   = 20000

    if ($major -eq 16 -and $minor -eq 0) {
        if ($build -gt $patchedBuild) {
            Write-Host 'PATCHED - PowerPoint version is newer than September 2026 patch baseline.'
            $exitCode = 0
        } elseif ($build -eq $patchedBuild -and $rev -ge $patchedRev) {
            Write-Host 'PATCHED - PowerPoint version meets September 2026 patch baseline.'
            $exitCode = 0
        } else {
            Write-Host 'VULNERABLE - PowerPoint version predates September 2026 patches. Update immediately.'
            $exitCode = 1
        }
    } else {
        Write-Host "UNKNOWN - Unexpected Office major version $major.$minor. Manual review needed."
        $exitCode = 2
    }
} catch {
    Write-Host "UNKNOWN - Error during check: $_"
    $exitCode = 2
}

exit $exitCode

Sources

1. Tenable September 2026 Patch Tuesday Analysis
2. CrowdStrike September 2026 Patch Tuesday Analysis
3. CVE-2026-80086 (sibling vuln) on Strix.ai
4. CVE-2026-80086 on OpenCVE
5. MSRC Security Update Guide
6. Vulners PT-2026-87886 Entry
7. Computerworld September 2026 Patch Tuesday Coverage