{"id":"CVE-2026-68809","aliases":[],"cve":{"records":[{"id":"CVE-2026-68809","source":"microsoft","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-07-31T16:41:44.243Z","published":"2026-08-11T17:05:12.137Z","modified":"2026-11-10T21:58:55.302Z"}],"publishers":[{"name":"microsoft","role":"CNA","organizationId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","modified":"2026-11-10T21:58:55.302Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-08-11T20:52:51.671Z"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68809","tags":["vendor-advisory","patch"],"source":"microsoft"}],"weaknesses":[{"id":"CWE-459","description":"CWE-459: Incomplete Cleanup","source":"microsoft"}],"applicability":[{"source":"microsoft","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:office_2019:*:*:*:*:*:*:*:*","versionStartIncluding":"19.0.0","versionEndExcluding":"https://aka.ms/OfficeSecurityReleases"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:365_apps:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"16.0.1","versionEndExcluding":"https://aka.ms/OfficeSecurityReleases"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:office_2021:*:*:*:*:long_term_servicing_channel:*:*:*","versionStartIncluding":"16.0.1","versionEndExcluding":"https://aka.ms/OfficeSecurityReleases"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:office_2024:*:*:*:*:long_term_servicing_channel:*:*:*","versionStartIncluding":"16.0.0","versionEndExcluding":"https://aka.ms/OfficeSecurityReleases"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:powerpoint_2016:*:*:*:*:*:*:*:*","versionStartIncluding":"16.0.0","versionEndExcluding":"16.0.5565.1001"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-08-11T20:38:14.940870Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Powerpoint Information Disclosure Vulnerability","titleSource":"microsoft","descriptionSource":"microsoft","description":"Incomplete cleanup in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.","score":5.5,"severity":"medium","published":"2026-08-11T17:05:12.137Z","modified":"2026-11-10T21:58:55.302Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Microsoft","name":"Microsoft 365 Apps for Enterprise","platforms":["32-bit Systems","x64-based Systems"],"versions":[{"version":"16.0.1","status":"affected","lessThan":"https://aka.ms/OfficeSecurityReleases","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-68809"},{"vendor":"Microsoft","name":"Microsoft Office 2019","platforms":["32-bit Systems","x64-based Systems"],"versions":[{"version":"19.0.0","status":"affected","lessThan":"https://aka.ms/OfficeSecurityReleases","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-68809"},{"vendor":"Microsoft","name":"Microsoft Office LTSC 2021","platforms":["32-bit Systems","x64-based Systems"],"versions":[{"version":"16.0.1","status":"affected","lessThan":"https://aka.ms/OfficeSecurityReleases","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-68809"},{"vendor":"Microsoft","name":"Microsoft Office LTSC 2024","platforms":["32-bit Systems","x64-based Systems"],"versions":[{"version":"16.0.0","status":"affected","lessThan":"https://aka.ms/OfficeSecurityReleases","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-68809"},{"vendor":"Microsoft","name":"Microsoft PowerPoint 2016","platforms":["32-bit Systems","x64-based Systems"],"versions":[{"version":"16.0.0","status":"affected","lessThan":"16.0.5565.1001","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-68809"}],"remediation":[],"references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68809"],"sources":[{"name":"CVE","id":"CVE-2026-68809","modified":"2026-11-10T21:58:55.302Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-68809"}],"assessments":[{"source":"microsoft","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C","score":5.5}],"sourceAffected":[],"observedAt":"2026-11-11T06:18:50.691Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T23:50:31.991Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-13T08:40:38.631Z","attemptedAt":"2026-11-13T08:40:38.631Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-13T08:35:33.046Z","attemptedAt":"2026-11-13T08:35:33.046Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-13T08:40:35.497Z","attemptedAt":"2026-11-13T08:40:35.497Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-13T08:35:33.543Z","attemptedAt":"2026-11-13T08:35:33.543Z"}],"evidence":[{"source":"GitHub Advisory Database","id":"GHSA-w4w4-4f94-xgg7","url":"https://github.com/advisories/GHSA-w4w4-4f94-xgg7","modified":"2026-08-11T18:31:49Z","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","checkedAt":"2026-11-13T08:35:33.046Z"},{"source":"FIRST EPSS","id":"CVE-2026-68809","url":"https://www.first.org/epss/","probability":0.00435,"percentile":0.38248,"date":"2026-11-12","checkedAt":"2026-11-13T08:35:33.543Z"},{"source":"ENISA EUVD","id":"EUVD-2026-56461","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-56461","modified":"Nov 10, 2026, 9:58:55 PM","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C","checkedAt":"2026-11-13T08:40:35.497Z"},{"source":"NVD","id":"CVE-2026-68809","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68809","modified":"2026-08-14T12:59:41.220","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","checkedAt":"2026-11-13T08:40:38.631Z"},{"source":"NVD","id":"CVE-2026-68809","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68809","modified":"2026-08-14T12:59:41.220","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","checkedAt":"2026-11-13T08:40:38.631Z"}],"aiSummary":{"text":"Microsoft Office PowerPoint has an information disclosure vulnerability due to incomplete cleanup, affecting versions 16.0.1, 19.0.0, and 16.0.0 of Microsoft 365 Apps for Enterprise, Microsoft Office 2019, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024. An unauthorized attacker can disclose information locally. The weakness is classified as CWE-459: Incomplete Cleanup.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:39:46.164Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-68809"}]}}