CVE-2026-114403

HIGH 8.1

PHPOffice PHPPresentation through 1.2.0 Deserialization via Reader\Serialized::load

CVSS Score

8.1

EPSS Score

0.0%

EPSS Percentile

0th

PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by supplying a crafted presentation file. Attackers can upload a ZIP containing PhpPresentation.xml that IOFactory::load passes to unserialize(), enabling gadget-chain code execution, file writes, or denial of service.

CWE	CWE-502
Vendor	phpoffice
Product	phppresentation
Published	Oct 21, 2026

Stay Ahead of the Next One

Get instant alerts for phpoffice phppresentation

Be the first to know when new high vulnerabilities affecting phpoffice phppresentation are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

PHPOffice / PHPPresentation

0 ≤ 1.2.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

hackmd.io: https://hackmd.io/@leediay/multiple_vulnerable_phppresentation github.com: https://github.com/PHPOffice/PHPPresentation/blob/1.2.0/src/PhpPresentation/Reader/Serialized.php#L77-L109 github.com: https://github.com/PHPOffice/PHPPresentation/blob/1.2.0/src/PhpPresentation/IOFactory.php#L39 github.com: https://github.com/PHPOffice/PHPPresentation vulncheck.com: https://www.vulncheck.com/advisories/phpoffice-phppresentation-through-1.2.0-deserialization-via-reader-serialized-load

Credits

leediay153 from Viettel Post