CVE-2026-55123

Think of this like a “gap” in PowerPoint’s ability to safely handle a particular kind of file. If someone sends you a specially crafted PowerPoint and you open it, that file can cause PowerPoint to misbehave and let an attacker run code on your computer. This is the kind of weakness attackers commonly use as a starting point for broader malware.

This matters to you if you use Microsoft PowerPoint as part of microsoft 365 apps, microsoft office, Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, or Microsoft PowerPoint 2016.
Because it requires user interaction (opening a crafted file) and does not require authentication, it can target everyday users through email or other file-sharing—especially if the attacker can reach your users.
Since “reachable in default config” is unknown and specific preconditions aren’t listed, treat it as a real risk anytime your systems can receive and open PowerPoint files from untrusted sources.

Mark this as urgent because a user-opening action can directly lead to arbitrary code running on the device (local execution) for affected PowerPoint editions. Even though public exploit code isn’t on record and KEV (CISA’s known-exploited list) isn’t present, the business risk remains high: opening a malicious attachment is enough.
With a RED verdict assigned, prioritize patching immediately across all affected Office/PowerPoint installations, then tighten file-handling until updates are verified.

Confirm whether you’re affected

• Identify which of the following you run: microsoft 365 apps, microsoft office, Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, Microsoft PowerPoint 2016.
• For Windows editions: determine the installed Office build/version (from within Office/PowerPoint “About” screens) and compare it against the security release channel fixes from Microsoft.
• For macOS editions listed below, confirm your installed version.

Apply the fix (use the exact fixed versions)

• Microsoft Office 365 for Mac: update to 16.111.26071215.
• Microsoft Office LTSC for Mac 2021: update to 16.111.26071215.
• Microsoft Office LTSC for Mac 2024: update to 16.111.26071215.
• Microsoft PowerPoint 2016: update to 16.0.5561.1000.
• Microsoft 365 Apps and Microsoft Office: install the update(s) published for Office security releases for CVE-2026-55123 (use the vendor’s Office security releases / update-guide page linked in the patch section).

After updating

• Re-check each machine’s installed build/version to ensure it matches the fixed version for that edition.
• Confirm that users can open typical PowerPoint files normally (optional smoke test) and that no update failed silently.

If patching is delayed (temporary workaround)

• Block or discourage opening PowerPoint files from untrusted sources (unknown email attachments, unexpected downloads, shared links from outside known vendors/clients).
• If your organization uses an email gateway or endpoint controls, tighten attachment/file handling rules for PowerPoint files until patching is complete.

What to monitor

• Look for user reports of suspicious “document” attachments and for PowerPoint/Office crashes around the time of an unexpected file open.
• If you have endpoint detection, monitor for unusual process creation shortly after PowerPoint launches.

Exploitation status note

• No clear dated exploitation claim and no public exploit code were found in the provided findings, and this CVE is not listed in the KEV set; however, the vulnerability’s nature (code execution after opening a crafted file) makes patching the key control.

CVE-2026-55123 is a Microsoft PowerPoint vulnerability that can lead to local arbitrary code execution when a user opens a specially crafted PowerPoint file. The core finding describes a buffer overflow (heap/stack not precisely determined in the findings, but characterized as a buffer overflow) that can be abused to overwrite memory and execute attacker-controlled code, corresponding to CWE-122 (heap-based/buffer overflow class) and CWE-681 (hardware/logic misuse category for attacker-controlled memory corruption outcomes).

Attack prerequisites: no authentication is required, but user interaction is required (the victim must open the crafted PowerPoint). The impact described includes confidentiality, integrity, and availability impacts on the local machine.

Exploitation maturity: KEV (CISA known-exploited vulnerabilities) is not listed, and no dated press exploitation claim or public exploit code was identified in the provided findings; however, the assigned RED verdict indicates this should be treated as a high-priority patching issue for affected Office/PowerPoint versions.

Patch guidance: fixed builds are available for macOS (16.111.26071215 for Office 365/LTSC for Mac editions named) and for Microsoft PowerPoint 2016 (16.0.5561.1000). For Microsoft 365 Apps and Microsoft Office, fixes are delivered via the vendor’s Office security release updates for this CVE.