Improper access control in Microsoft Office PowerPoint allows an authorized attacker to perform spoofing locally.
CVSS Details
CVSS Score
7.1
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Configurations (Affected Products)
No configuration data available.
Microsoft Office PowerPoint (具体受影响版本请参考官方MSRC公告)
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# Conceptual PoC for CVE-2026-41102
# This script demonstrates how one might structure a malicious PowerPoint file
# to bypass access controls and trigger spoofing locally.
import zipfile
import os
def create_malicious_pptx(filename):
# Create a basic pptx structure (zipped xml files)
with zipfile.ZipFile(filename, 'w') as z:
# Minimal content types required for a valid pptx
types_xml = '''<Types xmlns="http://schemas.openxmlformats.org/package/2006/content-types">
<Default Extension="rels" ContentType="application/vnd.openxmlformats-package.relationships+xml"/>
<Default Extension="xml" ContentType="application/xml"/>
</Types>'''
z.writestr('[Content_Types].xml', types_xml)
# Minimal presentation structure
# In a real exploit, specific XML tags would be crafted to bypass access checks
presentation_xml = '''<p:presentation xmlns:p="http://schemas.openxmlformats.org/presentationml/2006/main">
<p:slideMasterIdLst/>
</p:presentation>'''
z.writestr('ppt/presentation.xml', presentation_xml)
print(f"[*] Created crafted file: {filename}")
print("[*] To exploit: Execute/Parse this file locally on the target system.")
print("[!] Expected Result: Spoofing of authentication or interface elements.")
if __name__ == "__main__":
create_malicious_pptx('exploit_cve_2026_41102.pptx')