CVE-2026-72956 Microsoft CVE debrief

Who should care

Defenders responsible for Microsoft Office PowerPoint installations, particularly in environments where unauthorized access may be a concern, should assess exposure and apply patches.

Why it matters

CVE-2026-72956 is a MEDIUM-severity vulnerability in Microsoft Office PowerPoint that allows information disclosure over a network. Defenders should prioritize verifying exposure and applying patches.

• Verify exposure in Microsoft Office PowerPoint installations
• Apply patches from Microsoft to prevent information disclosure
• Monitor for unauthorized access attempts to sensitive information

Technical summary

The vulnerability is caused by an untrusted pointer dereference in Microsoft Office PowerPoint, allowing an unauthorized attacker to disclose information over a network. This issue affects multiple Microsoft Office products, including Microsoft 365 Apps for Enterprise, Microsoft Office 2019, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024. Defenders should prioritize verifying exposure in these installations and applying patches from Microsoft to prevent information disclosure.

Defensive priority

Defenders should prioritize verifying exposure in Microsoft Office PowerPoint installations and applying patches from Microsoft.

Recommended defensive actions

• Verify exposure in Microsoft Office PowerPoint installations
• Apply patches from Microsoft
• Monitor for unauthorized access attempts

Evidence notes

The CVE record and source item provide details on the vulnerability, affected products, and references to vendor advisories. The vulnerability affects Microsoft 365 Apps for Enterprise, Microsoft Office 2019, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024. Defenders should verify exposure and apply patches from Microsoft. The information provided is based on available data and may not be exhaustive. Further verification is necessary to ensure complete exposure assessment.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.