Microsoft PowerPoint CVE-2026-88207

Exploitation requires a user to open an attacker-crafted PowerPoint presentation (UI:R) delivered out-of-band via email, chat, or a web download - there is no exposed network service to attack directly. The AC:H metric indicates additional attacker-side prerequisites beyond simply sending the file, such as achieving a specific heap memory layout to make the CWE-122 overflow reliably exploitable, which reduces real-world reliability. Code executes with the privileges of the opening user, and Protected View / Mark-of-the-Web sandboxing on files from untrusted sources is a practical mitigating factor. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and Office/Office LTSC for Mac 2021/2024; default-configuration PowerPoint on these versions is exposed, so the main limiting factors are the required user interaction and the high attack complexity.

This is a genuine but second-tier priority. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.5 HIGH) describes an unauthenticated, network-delivered remote code execution with full C/I/A impact, but two metrics materially blunt real-world risk: AC:H indicates the attacker must satisfy non-trivial conditions (e.g. heap grooming or specific memory layout) that are not reliably controllable, and UI:R means a human must open the crafted file - this is not a wormable, zero-click flaw. No EPSS score, KEV listing, or public POC is present in the provided intelligence, so there is no evidence of active or imminent exploitation; the signals are therefore consistent and non-conflicting (high theoretical impact, meaningful practical friction). The one cross-source note worth flagging: the description phrase 'execute code over a network' is Microsoft's standard wording for file-delivered Office RCE rather than a listening network service - AV:N here reflects email/web delivery of a malicious document, not direct remote service exploitation; defenders should read it as such. Net: patch on the normal Patch-Tuesday cadence and prioritize endpoints that open untrusted presentations, but this does not warrant emergency out-of-band response absent new exploitation evidence.

An attacker emails or hosts a specially crafted PowerPoint presentation and lures a user into opening it; parsing the malformed object triggers a heap-based buffer overflow (CWE-122) that corrupts memory and leads to arbitrary code execution in the context of the current user. Because CVSS specifies UI:R and AC:H, successful exploitation depends on the victim opening the file and on the attacker reliably achieving the required heap state. No public exploit code is identified in the provided data.