CVE-2026-72938
MediumCVSS 6.5Exploitation Probability (EPSS)
Elevated risk59th percentile - higher than 59% of all known CVEs
Summary
Access of resource using incompatible type ('type confusion') in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
Risk Assessment
A remote attacker could exploit this to access data, potentially compromising information confidentiality.
Recommendation
Apply Microsoft Office security updates to remediate this vulnerability.
Other vulnerabilities in Microsoft Office PowerPoint
See all- CVE-2026-41102High
Improper access control in Microsoft Office PowerPoint allows an authorized attacker to perform spoofing locally.
- CVE-2026-80086Medium
Out-of-bounds read in Microsoft Office PowerPoint. An unauthorized attacker can disclose information over a network.
- CVE-2026-80081High
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
- CVE-2026-78513Medium
An out-of-bounds read vulnerability in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.
- CVE-2026-72977Medium
An out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
- CVE-2026-72975Medium
An out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
- CVE-2026-72956Medium
Untrusted pointer dereference in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
- CVE-2026-69797High
A use-after-free vulnerability in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
- CVE-2026-69767High
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
- CVE-2026-69678High
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
Original NVD description (English source)
Access of resource using incompatible type ('type confusion') in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS