CVE-2026-72938
MediumCVSS 6.5Exploitation Probability (EPSS)
Elevated risk59th percentile - higher than 59% of all known CVEs
Summary
Access of resource using incompatible type ('type confusion') in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
Risk Assessment
A remote attacker could exploit this to access data, potentially compromising information confidentiality.
Recommendation
Apply Microsoft Office security updates to remediate this vulnerability.
Other vulnerabilities in Microsoft Office PowerPoint
See all- CVE-2026-88178Critical
Use-after-free vulnerability in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
- CVE-2026-108455Medium
Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
- CVE-2026-108454Medium
Buffer over-read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
- CVE-2026-108453Medium
Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
- CVE-2026-97744Medium
Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. The attacker can read data outside the intended memory bounds.
- CVE-2026-97005Medium
Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.
- CVE-2026-88207High
Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
- CVE-2026-88203Medium
An untrusted pointer dereference in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
- CVE-2026-88183Medium
An out-of-bounds read vulnerability in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
- CVE-2026-88144High
A use after free vulnerability in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
Original NVD description (English source)
Access of resource using incompatible type ('type confusion') in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS