AI description
Automated description summarized from trusted sources.
CVE-2026-41102 is an improper access control vulnerability found in Microsoft Office PowerPoint. This flaw allows an authorized attacker to perform local spoofing. The vulnerability is part of a broader set of issues, collectively referred to as "FlagLeft," affecting several Microsoft 365 Android applications. It stems from a debug flag inadvertently left enabled in a shared Microsoft SDK, which could allow a malicious application on the same device to steal long-lived authentication tokens.
- Description
- Improper access control in Microsoft Office PowerPoint allows an authorized attacker to perform spoofing locally.
- Source
- secure@microsoft.com
- NVD status
- Analyzed
- Products
- powerpoint
CVSS 3.1
- Type
- Primary
- Base score
- 5.5
- Impact score
- 3.6
- Exploitability score
- 1.8
- Vector string
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- Severity
- MEDIUM
- secure@microsoft.com
- CWE-284
- Hype score
- Not currently trending
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:powerpoint:*:*:*:*:*:android:*:*",
"matchCriteriaId": "D5E8889D-3E4D-4E4A-9ED2-F1D089E203ED",
"versionEndExcluding": "16.0.19822.20190",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]