PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-114403 PHPOffice CVE debrief

PHPOffice PHPPresentation through 1.2.0 contains a critical insecure deserialization vulnerability via Reader/Serialized::load, allowing attackers to instantiate arbitrary PHP objects by supplying a crafted presentation file, potentially enabling code execution, file writes, or denial of service. This vulnerability is particularly concerning due to the widespread use of PHPPresentation in various applications, making it a high-priority issue for defenders to address. The vulnerability's impact can be significant, as it allows for gadget-chain code execution, which can lead to unauthorized access, data breaches, or system compromise.

Vendor
PHPOffice
Product
PHPPresentation
CVSS
CRITICAL 9.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-21
Original CVE updated
2026-10-28
Advisory published
2026-10-21
Advisory updated
2026-10-28

Who should care

Defenders handling PHPPresentation installations, especially those processing untrusted presentation files, should assess exposure and implement secure deserialization practices. This includes reviewing current installations, verifying versions, and applying patches or mitigations as necessary. Additionally, defenders should monitor for suspicious activity and implement compensating controls to mitigate potential impacts.

Why it matters

CVE-2026-114403 is a critical insecure deserialization vulnerability in PHPOffice PHPPresentation through 1.2.0. Defenders should assess exposure, especially in systems handling untrusted presentation files, and prioritize secure deserialization practices and version verification.

  • Potential code execution through gadget-chain exploitation.
  • Possible file writes or modifications through deserialization.
  • Denial of service through crafted presentation file processing.
  • Verification of PHPPresentation version and secure deserialization practices required.

Technical summary

PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability via Reader/Serialized::load. Attackers can supply a crafted presentation file to instantiate arbitrary PHP objects, potentially enabling gadget-chain code execution, file writes, or denial of service. The vulnerability arises from the insecure use of the unserialize() function, which can be exploited by uploading a maliciously crafted presentation file. This can lead to significant security risks, including code execution and unauthorized access.

Defensive priority

High priority for systems using PHPPresentation, especially those handling untrusted presentation files.

Recommended defensive actions

  • Assess exposure of PHPPresentation installations, especially those handling untrusted presentation files.
  • Verify version 1.2.0 or earlier is in use and consider upgrading to a patched version.
  • Implement secure deserialization practices for PHPPresentation.
  • Monitor for suspicious presentation file uploads or processing.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on the vulnerability, affected versions, and potential impacts. However, specific exploitation details and remediation steps require verification from official sources.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-114403 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-114403

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-114403 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-114403

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • PHPOffice PHPPresentation through 1.2.0 Deserialization via Reader\Serialized::load

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/114xxx/CVE-2026-114403.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://hackmd.io/@leediay/multiple_vulnerable_phppresentation

    Supplemental source - third-party-advisory

  • Source reference

    Unverified legacy reference

    URL: https://github.com/PHPOffice/PHPPresentation/blob/1.2.0/src/PhpPresentation/Reader/Serialized.php

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/PHPOffice/PHPPresentation/blob/1.2.0/src/PhpPresentation/IOFactory.php

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/PHPOffice/PHPPresentation

    Supplemental source - product

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/phpoffice-phppresentation-through-1.2.0-deserialization-via-reader-serialized-load

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.