CVE-2026-55120

This is a flaw in PowerPoint that can be abused by a “bad” document to break how the program manages memory. If that document is opened, it can let an attacker run malicious code on the computer. Think of it like a lock with a hidden weakness: the attack doesn’t need permission ahead of time beyond getting the file opened.

This matters if your business uses Microsoft Office/PowerPoint on Windows or macOS, including Microsoft 365 apps, Microsoft Office, Microsoft 365/Office for Mac, and the specific PowerPoint/Office versions listed in the affected set. The risk is tied to files being opened in the vulnerable PowerPoint; there’s no indication from the findings that this requires an existing account inside your business. Treat it as a realistic risk whenever staff handle emails or files from untrusted sources and open them in the affected PowerPoint versions.

Verdict: RED. PowerPoint remote code execution means a successful attack can take over a user’s computer, install malware, and expose business data. Even though there’s no confirmed dated real-world claim in the findings and no public exploit code listed, you should still patch immediately because the impact is high and the fix is available.

Confirm exposure

• Inventory what’s installed: Microsoft 365 apps, Microsoft Office (Windows), Microsoft PowerPoint 2016 (Windows), and the listed Microsoft Office for Mac / LTSC for Mac variants.
• For each Mac install, record the exact version number so you can compare it to the fixed version.

Apply the fixed versions

• Microsoft 365 apps and Microsoft Office (Windows): update via Microsoft’s Office security releases page for CVE-2026-55120: https://aka.ms/OfficeSecurityReleases
• Microsoft Office 365 for Mac: upgrade to 16.111.26071215
• Microsoft Office LTSC for Mac 2021: upgrade to 16.111.26071215
• Microsoft Office LTSC for Mac 2024: upgrade to 16.111.26071215
• Microsoft PowerPoint 2016 (Windows): upgrade to 16.0.5561.1000

If patching is delayed (temporary workaround)

• Restrict who can open and download unexpected attachments.
• Instruct staff not to open PowerPoint files from unknown senders or unexpected messages.
• Coordinate with IT to tighten email/file handling controls (e.g., quarantine untrusted attachments) until the fixed versions are in place.

What to monitor

• After updating, confirm Office/PowerPoint versions changed to the fixed levels above.
• Watch for follow-on activity on endpoints (new suspicious processes initiated around the time PowerPoint files were opened).

Reference

• Microsoft’s update guidance for CVE-2026-55120: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55120

Severity/impact: This is a memory corruption issue (CWE-122) in Microsoft PowerPoint that can lead to remote code execution on the victim system, i.e., an attacker can run code in the context of the user after triggering the vulnerability via crafted input.

Exploitation status: The findings do not list this in the CISA KEV catalog and do not provide a clear dated real-world exploitation claim. There is also no public exploit code on record.

Patch availability: Fixed versions are available as follows: Microsoft 365 apps and Microsoft Office via Microsoft’s Office security releases; Microsoft Office 365 for Mac, Office LTSC for Mac 2021, and Office LTSC for Mac 2024 fixed in 16.111.26071215; Microsoft PowerPoint 2016 fixed in 16.0.5561.1000.

Attack vector (from the overall description and impact pattern): The practical trigger is opening a specially crafted Office file in PowerPoint, leading to a heap-based buffer overflow condition (as described in the backstop).

EPSS: A predicted likelihood was provided in the findings, but the findings do not indicate confirmed in-the-wild exploitation, so the public blocks should focus on patching and exposure checking rather than relying on prediction scores.

What KEV means here: KEV would indicate confirmed exploitation, but this CVE is not listed in KEV per the provided findings.