{"id":"CVE-2026-120001","kind":"vulnerability","aliases":["CVE-2026-120001"],"related":[],"title":"Microsoft PowerPoint: heap overflow lets an attacker run code over a network","description":"Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.","summary":"A heap-based buffer overflow in Microsoft Office PowerPoint lets an unauthorized attacker execute code over a network. The sources give a CVSS score of 8.8 but do not describe the exact trigger or the affected Office versions.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Microsoft 365 Apps for Enterprise","fixed":["2610 20527.20196"],"affected":">= 16.0.1, < builds in Nov 10 2026 release notes (2610 20527.20196)","ecosystem":"vendor"},{"name":"Microsoft Office LTSC 2024","fixed":["16.0.17932.21140"],"affected":">= 16.0.0, < 16.0.17932.21140","ecosystem":"vendor"},{"name":"Microsoft Office LTSC 2021","fixed":["16.0.14334.21048"],"affected":">= 16.0.1, < 16.0.14334.21048","ecosystem":"vendor"},{"name":"Microsoft Office for Mac (365, LTSC 2021, LTSC 2024)","fixed":["16.115.26110837"],"affected":"< 16.115.26110837","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["desktop","macos","microsoft-office","other","powerpoint","windows"],"not_affected_if":["patched-build"],"how_to_check":"In any Office app: File > Account > About, compare the build with the fixed builds (e.g. 16.0.17932.21140 for LTSC 2024, 16.0.14334.21048 for LTSC 2021, Mac 16.115.26110837). Anything older is affected.","fix":"Install the November 10, 2026 Office security update: Current Channel / Office 2024 / 2021 Retail 2610 build 20527.20196 or later; Monthly Enterprise 2609 build 20430.20264, 2608 build 20326.20320; Office LTSC 2024 build 16.0.17932.21140; Office LTSC 2021 build 16.0.14334.21048; Office for Mac (365, LTSC 2021/2024) 16.115.26110837.","status":"open","published_at":"2026-11-10T19:20:25+00:00","first_seen_at":"2026-11-10T19:25:07+00:00","triaged_at":"2026-11-10T19:27:57+00:00","updated_at":"2026-11-10T22:06:52+00:00","category":"other","confidence":0.75,"triage":{"at":"2026-11-10T19:27:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft PowerPoint: heap overflow lets an attacker run code over a network","impact":"high","summary":"A heap-based buffer overflow in Microsoft Office PowerPoint lets an unauthorized attacker execute code over a network. The sources give a CVSS score of 8.8 but do not describe the exact trigger or the affected Office versions.","audience":"businesses","category":"other","nicknames":[],"who_cares":["microsoft-office","powerpoint","windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"code runs on the victim's machine via a crafted file","analyst_note":"Find the Microsoft Security Response Center advisory for CVE-2026-120001 to confirm affected versions, trigger, and the patch.","how_to_check":"- unknown","plain_action":"","product_name":"Microsoft Office PowerPoint","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000656,"input_tokens":4502,"output_tokens":411,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Microsoft Security Response Center advisory for CVE-2026-120001 to confirm affected versions, trigger, and the patch.","search":"'-120001':15A,18A '-2026':14A,17A '2021':31A,38A '2024':27A,40A '365':20A,36A '8.8':75B 'affect':85B 'allow':97C 'apps':21A 'attack':7A,62B,100C 'base':52B,90C 'buffer':53B,91C 'code':9A,64B,103C 'cve':13A,16A 'cvss':72B 'describ':79B 'desktop':41B 'enterprise':23A 'exact':81B 'execut':63B,102C 'for':22A,34A 'give':70B 'heap':3A,51B,89C 'heap-bas':50B,88C 'let':5A,59B 'ltsc':26A,30A,37A,39A 'mac':35A 'maco':42B 'microsoft':1A,19A,24A,28A,32A,44B,56B,94C 'microsoft-offic':43B 'network':12A,67B,106C 'offic':45B,57B,86B,95C 'office':25A,29A,33A 'overflow':4A,54B,92C 'powerpoint':2A,47B,58B,96C 'run':8A 'score':73B 'sourc':69B 'trigger':82B 'unauthor':61B,99C 'version':87B 'window':48B","nicknames":[],"mitigations":[],"who_affected":"Anyone running PowerPoint from Microsoft 365 Apps, Office LTSC 2021/2024 or Office for Mac (365, LTSC 2021/2024) at a build older than the November 10, 2026 update. The CVSS vector (AV:N, UI:R) says the user must take an action such as opening a crafted file; Microsoft's page text I could read does not give the exact trigger. Teams whose Office updates automatically to the November builds can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T22:06:52Z","by":"analyst","doc":"https://nvd.nist.gov/vuln/detail/cve-2026-120001","run_id":2922}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["365appsforenterprise","microsoft365appsforenterprise","microsoftofficeformac365ltsc2021ltsc2024","microsoftofficeltsc2021","microsoftofficeltsc2024","officeformac365ltsc2021ltsc2024","officeltsc2021","officeltsc2024"],"ptokens":["2021","2024","365","apps","enterprise","for","ltsc","mac","microsoft","office"],"labels":["desktop","high","macos","microsoftoffice","other","powerpoint","vendor","windows"],"campaign_type":null,"search_a":"'-120001':15A,18A '-2026':14A,17A '2021':31A,38A '2024':27A,40A '365':20A,36A 'apps':21A 'attack':7A 'code':9A 'cve':13A,16A 'enterprise':23A 'for':22A,34A 'heap':3A 'let':5A 'ltsc':26A,30A,37A,39A 'mac':35A 'microsoft':1A,19A,24A,28A,32A 'network':12A 'office':25A,29A,33A 'overflow':4A 'powerpoint':2A 'run':8A","search_b":"'8.8':75B 'affect':85B 'attack':62B 'base':52B 'buffer':53B 'code':64B 'cvss':72B 'describ':79B 'desktop':41B 'exact':81B 'execut':63B 'give':70B 'heap':51B 'heap-bas':50B 'let':59B 'maco':42B 'microsoft':44B,56B 'microsoft-offic':43B 'network':67B 'offic':45B,57B,86B 'overflow':54B 'powerpoint':47B,58B 'score':73B 'sourc':69B 'trigger':82B 'unauthor':61B 'version':87B 'window':48B","search_c":"'allow':97C 'attack':100C 'base':90C 'buffer':91C 'code':103C 'execut':102C 'heap':89C 'heap-bas':88C 'microsoft':94C 'network':106C 'offic':95C 'overflow':92C 'powerpoint':96C 'unauthor':99C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120001","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120001","severity":null,"published_at":"2026-11-10T19:20:25+00:00","modified_at":"2026-11-10T19:20:26+00:00","first_seen_at":"2026-11-10T19:25:07+00:00","fetched_at":"2026-11-10T19:25:07+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120001:2922","url":"https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates","severity":null,"published_at":"2026-11-10T22:06:52+00:00","modified_at":"2026-11-10T22:06:52+00:00","first_seen_at":"2026-11-10T22:06:52+00:00","fetched_at":"2026-11-10T22:06:52+00:00","note":"MSRC page is JS-only and unreadable; fix builds verified on Microsoft Learn Nov 10 2026 release notes (lists CVE under PowerPoint); affected ranges from Microsoft CNA data via NVD. No exploitation or PoC reported. Trigger not stated in readable sources.","cites":["https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates","https://nvd.nist.gov/vuln/detail/cve-2026-120001"]}],"documents":[{"id":118854,"url":"https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates","title":"Release notes for Microsoft Office security updates (Nov 10, 2026)","kind":"vendor","source":"analyst","publisher":null,"text":"November 10, 2026: Current Channel 2610 (20527.20196); MEC 2610 (20527.20194), 2609 (20430.20264), 2608 (20326.20320); SAEC 2610 (20527.20192), 2609 (20430.20262), 2608 (20326.20318); Office 2024/2021 Retail 2610 (20527.20196); LTSC 2024 2408 (17932.21140); LTSC 2021 2108 (14334.21048); Office 2019 1808 (10417.20236). CVE-2026-118301 listed under Excel.","published_at":null,"relation":"fix","confidence":null,"note":null},{"id":119384,"url":"https://nvd.nist.gov/vuln/detail/cve-2026-120001","title":"NVD CVE-2026-120001 (CNA data from Microsoft)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}