Microsoft PowerPoint CVE-2026-88178

Exploitation requires an attacker to deliver a specially crafted PowerPoint presentation to the target and have it opened or rendered by a vulnerable Office build - affected products include Microsoft Office LTSC 2021 (<16.0.14334.20974), LTSC 2024 (<16.0.17932.21056), Microsoft 365 Apps for Enterprise, and the macOS Office LTSC 2021/2024 and 365 for Mac editions. The primary limiting factor is that, despite the input vector's UI:N, a file-format use-after-free in PowerPoint realistically depends on the victim opening/previewing the malicious document; there is no evidence of a network-listening service that can be hit without any user action. Code executes with the privileges of the user who opens the file, so least-privilege user contexts limit blast radius.

Raw CVSS rates this 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), implying unauthenticated remote code execution with no user interaction. However, this is a file-format use-after-free (CWE-416) in Microsoft Office PowerPoint, and the description's phrasing ('execute code over a network') combined with the product class strongly implies the victim must open or preview a malicious presentation - the UI:N metric conflicts with the realistic delivery model for Office document parsing bugs (verify with Microsoft; preview-pane rendering is the usual justification for UI:N on Office flaws). CISA's SSVC framework reports Exploitation: none (no observed exploitation), Automatable: yes, Technical Impact: total - so the technical severity is genuine but there is no current evidence of weaponization. No EPSS score was provided, the CVE is not in CISA KEV, and no public exploit was supplied, so there is no public exploit identified at time of analysis. Net: a legitimately high-impact, high-prevalence memory-corruption bug that warrants prompt patching given SSVC 'total impact' and 'automatable: yes', but it is a priority driven by potential and product ubiquity rather than by confirmed in-the-wild exploitation.

An attacker emails or hosts a crafted PowerPoint file and lures a target into opening (or previewing) it, triggering a use-after-free in the Office parser that yields code execution in the context of the current user. No public exploit code was provided, and SSVC lists exploitation as 'none,' so this is a plausible rather than observed scenario. Factoring in AV:N and AC:L, the technical barrier is low once the file reaches and is opened by the victim.