AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

MicrosoftCVE-2026-72938

Microsoft Office PowerPoint: type confusion

Microsoft

CVE-2026-72938 · Published Sep 8, 2026 · updated Sep 17, 2026

Medium6.5
Fix: upgrade to 16.0.20326.20138 or later (5 fixed versions below)
Microsoft advisory

Access of resource using incompatible type ('type confusion') in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.

Affected versions

PackageAffectedFixed in
Microsoft 365 Apps for Enterprise
Product
>= 16.0.1, < 16.0.20326.2013816.0.20326.20138
Microsoft Office 2019
Product
>= 19.0.0, < 16.0.10417.2020716.0.10417.20207
Microsoft Office 365 for Mac
Product
>= 1.0.0, < 16.113.2609143316.113.26091433
Microsoft Office LTSC 2021
Product
>= 16.0.1, < 16.0.14334.2090616.0.14334.20906
Microsoft Office LTSC 2024
Product
>= 16.0.0, < 16.0.17932.2097616.0.17932.20976
Microsoft Office LTSC for Mac 2021
Product
>= 16.0.1, < 16.113.2609143316.113.26091433
Microsoft Office LTSC for Mac 2024
Product
>= 16.0.0, < 16.113.2609143316.113.26091433
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-822, CWE-843

More Microsoft advisories

All Microsoft
High 8.3Sep 8Microsoft Skype for Business: spoofingCVE-2026-69646fixed in 6.0.9319.885 +2Medium 6.5Sep 8Microsoft Skype for Business: cross-site scriptingCVE-2026-69642fixed in 6.0.9319.885 +2High 7.1Sep 8Microsoft Skype for Business: spoofingCVE-2026-66305fixed in 6.0.9319.885 +2Medium 6.5Sep 8Microsoft Skype for Business: information disclosureCVE-2026-66306fixed in 6.0.9319.885 +2High 7.5Sep 8Microsoft Skype for Business: integer overflowCVE-2026-66307fixed in 6.0.9319.885 +2Medium 6.5Sep 8Microsoft Skype for Business: out-of-bounds readCVE-2026-66308fixed in 6.0.9319.885 +2