CVE-2025-49705 - Microsoft PowerPoint Remote Code Execution Vulnerability

HIGH

Microsoft PowerPoint Remote Code Execution Vulnerability

Published Jul 8, 2025

7.8

HIGH

CVSS 3.1

EPSS 0.41%

Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.

Vendor Microsoft Product Microsoft 365 Apps for Enterprise Default
unknown
Affected
- ≥ 16.0.1, < https://aka.ms/OfficeSecurityReleases
Vendor Microsoft Product Microsoft Office 2019 Default
unknown
Affected
- ≥ 19.0.0, < https://aka.ms/OfficeSecurityReleases
Vendor Microsoft Product Microsoft Office LTSC 2021 Default
unknown
Affected
- ≥ 16.0.1, < https://aka.ms/OfficeSecurityReleases
Vendor Microsoft Product Microsoft Office LTSC 2024 Default
unknown
Affected
- ≥ 16.0.0, < https://aka.ms/OfficeSecurityReleases
Vendor Microsoft Product Microsoft Office LTSC for Mac 2021 Default
unknown
Affected
- ≥ 16.0.1, < 16.99.25071321
Vendor Microsoft Product Microsoft Office LTSC for Mac 2024 Default
unknown
Affected
- ≥ 16.0.0, < 16.99.25071321
Vendor Microsoft Product Microsoft PowerPoint 2016 Default
unknown
Affected
- ≥ 16.0.0, < 16.0.5508.1000

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Microsoft	Microsoft 365 Apps for Enterprise	unknown	Affected ≥ 16.0.1, < https://aka.ms/OfficeSecurityReleases
Microsoft	Microsoft Office 2019	unknown	Affected ≥ 19.0.0, < https://aka.ms/OfficeSecurityReleases
Microsoft	Microsoft Office LTSC 2021	unknown	Affected ≥ 16.0.1, < https://aka.ms/OfficeSecurityReleases
Microsoft	Microsoft Office LTSC 2024	unknown	Affected ≥ 16.0.0, < https://aka.ms/OfficeSecurityReleases
Microsoft	Microsoft Office LTSC for Mac 2021	unknown	Affected ≥ 16.0.1, < 16.99.25071321
Microsoft	Microsoft Office LTSC for Mac 2024	unknown	Affected ≥ 16.0.0, < 16.99.25071321
Microsoft	Microsoft PowerPoint 2016	unknown	Affected ≥ 16.0.0, < 16.0.5508.1000

No remediation recorded yet.

Weaknesses (1)

CWE-122

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-20553		Advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49705		vendor-advisorypatchVendor Advisory

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner microsoft

Published Jul 8, 2025

Updated Feb 13, 2026

Reserved Jun 9, 2025

CISA Vulnrichment

Updated Jul 9, 2025

NVD

Status Analyzed

Modified Jun 17, 2026

Red Hat

No data

ENISA EUVD

Assigner microsoft

Published Jul 8, 2025

Updated Feb 13, 2026

GitHub

No data