CVE-2026-55043

This vulnerability is like a weakness in PowerPoint’s “file reader.” If an attacker sends you a specially crafted PowerPoint file, opening it could trick PowerPoint into letting malicious code run on your computer. If that happens, it could lead to malware taking over your device and accessing your business information.

This matters if your business uses Microsoft PowerPoint as part of Microsoft 365 Apps, Microsoft Office (including Office 2019/2021/2024), or any supported Mac editions listed in the affected set. Because the weakness is triggered by opening a crafted document, it becomes a real risk when attackers can deliver a malicious file to your users. Based on the information available here, there’s no indication of broad, confirmed internet-wide scanning or known public exploitation—still, you should treat this as reachable through normal phishing-style file delivery.

Verdict is RED: Microsoft has a fix, and this is a remote code execution class issue tied to opening a malicious document. Even without confirmed public exploit code, attackers commonly weaponize office-document handling bugs via targeted emails, so you should act now and not wait for further news.

1. Inventory exposure

   • Identify every device that has any of these installed and in use: Microsoft 365 Apps, Microsoft Office (Office 2019/2021/2024 and PowerPoint), and the listed Mac products (Microsoft Office 365 for Mac; Office LTSC for Mac 2021; Office LTSC for Mac 2024).
   • For each device, capture the installed Office/PowerPoint version (PowerPoint → Help/About or Settings → Apps).

2. Determine whether it’s fixed on your version

   • Windows / Microsoft Office channels: apply Microsoft Office security updates from https://aka.ms/OfficeSecurityReleases and confirm you’re on the fixed build for CVE-2026-55043.
   • Mac: update Office components to 16.111.26071215 (this single version is listed as the fix for Microsoft Office 365 for Mac, Office LTSC for Mac 2021, and Office LTSC for Mac 2024).

3. Upgrade

   • Apply the Office security update package(s) from Microsoft’s OfficeSecurityReleases page for your applicable editions.
   • On Mac, run the normal Microsoft Office updater until the installed version shows 16.111.26071215.

4. Validate

   • Re-check the “About” version in PowerPoint after updating.
   • Confirm updates succeeded on all user devices (not just a subset).

5. If patching is delayed (temporary containment)

   • Treat email attachments and download sources as untrusted: do not open unexpected Office files.
   • Ensure users are warned to only open documents from expected senders, and consider temporarily restricting macros/active content in your Office configuration while updates roll out (note: this is not a replacement for patching).

6. What to monitor

   • Look for crashes or suspicious Office activity around the time of document opens.
   • If you have endpoint detection/antivirus, review alerts related to Office/PowerPoint process behavior and newly dropped files.

CVE-2026-55043 is a Microsoft PowerPoint remote code execution vulnerability involving memory corruption (heap-based buffer overflow), mapped to CWE-122 (Heap-based buffer overflow) and CWE-190 (Integer overflow or wraparound-related issues). The weakness is triggered during PowerPoint’s handling of crafted documents, where the attacker can cause unauthorized code execution on the affected machine after user interaction (opening the file).

Findings summary: no KEV listing was found; there is no clear dated real-world exploitation claim in the provided press/news findings; and no public exploit code is reported. Microsoft released fixes for multiple Office/PowerPoint products, including Mac at 16.111.26071215 and other Microsoft Office channels via https://aka.ms/OfficeSecurityReleases. The overall traffic-light verdict for this CVE has been set to RED.