EUVD-2026-100169
GHSA-8r4r-v2g9-4686
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted PPTX via email/link
-
DeliveryVictim opens file in PowerPoint
-
ExploitTrigger use-after-free in object handling
-
ExecutionReuse freed memory for control flow
-
ImpactExecute arbitrary code as user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a user to open a maliciously crafted PowerPoint/Office document in a vulnerable build (per CVSS UI:R); no prior authentication or privileges are needed (PR:N). The limiting factors are this mandatory user interaction and the need for an affected version - e.g. Microsoft 365 Apps for Enterprise, Office LTSC 2021 before 16.0.14334.20974, Office LTSC 2024 before 16.0.17932.21056, and the macOS Office builds listed in the EUVD data. SSVC marks the issue non-automatable, reflecting that each victim must individually open the file; there is no indication of a non-default configuration requirement. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a low-complexity, unauthenticated remote code execution flaw whose only real gate is user interaction (UI:R) - consistent with a file-delivery attack where a victim opens a malicious PowerPoint document. The signals are mixed on urgency: technical impact is severe (SSVC 'total', full C/I/A loss), but the SSVC exploitation state is 'none' and the SSVC 'Automatable: no' value aligns with the UI:R requirement, meaning mass/wormable exploitation is unlikely. No EPSS score was supplied, the CVE is NOT in CISA KEV, and no public POC is indicated, so there is no public exploit identified at time of analysis. Net assessment: this is a genuinely high-severity, patch-now issue for any environment running Office/PowerPoint, but it is a user-interaction-dependent client-side bug rather than a self-propagating or server-side mass-exploitation threat - prioritize it in normal Patch Tuesday cadence rather than as an emergency, absent new exploitation evidence. Note the 'Denial Of Service' tag conflicts with the RCE impact shown in the description and vector. |
| Exploit ScenarioDerived | An attacker crafts a malicious PowerPoint file that triggers the use-after-free (CWE-416) and emails or otherwise delivers it to a target. When the victim opens the file in a vulnerable Office/PowerPoint build, the freed-object reuse is exploited to execute arbitrary code in the context of the user. No public exploit is identified at time of analysis, and successful attack requires the victim to open the attacker-supplied document (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Remote code execution in Microsoft PowerPoint stems from a use-after-free memory corruption flaw (CWE-416) that an unauthenticated remote attacker can trigger by delivering a maliciously crafted PowerPoint/Office document to a victim, who must then open it (CVSS 3.1 base 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021 before 16.0.14334.20974, Office LTSC 2024 before 16.0.17932.21056, and the macOS Microsoft 365/Office LTSC releases identified in EUVD-2026-100169. CISA SSVC records exploitation as 'none' and automatable as 'no', so no public exploit identified at time of analysis, and Microsoft has published fixed versions through the MSRC update guide.
RemediationAI
Vendor-released patch: Microsoft has shipped fixes - Office LTSC 2021 must be updated to 16.0.14334.20974 or later and Office LTSC 2024 to 16.0.17932.21056 or later, while Microsoft 365 Apps for Enterprise should be brought to the current builds listed at https://aka.ms/OfficeSecurityReleases; macOS Office LTSC/Microsoft 365 for Mac fixes should be applied as published per the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70215. Until every endpoint is patched, the practical compensating controls all target the UI:R delivery vector rather than a configuration toggle: enforce Mark of the Web and keep Protected View enabled for documents from the internet and email attachments (trade-off: prompts and reduced rendering fidelity for legitimate external files), and block or quarantine externally sourced .ppt/.pptx/.ppsx/.pptm attachments at the mail gateway and web proxy (trade-off: legitimate business attachments are delayed or require user release). Blocking macros or disabling ActiveX does not address this bug because exploitation occurs through document parsing rather than macro execution, so endpoint attack-surface-reduction rules that block Office child processes from spawning may only partially blunt post-exploitation behavior and should not be treated as a substitute for patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a use-after-free (CWE-416) in Microsoft Office PowerPoint's handling of document content: memory for an object is freed but subsequently dereferenced during processing of a crafted presentation, producing heap corruption that an attacker can shape into controlled code execution in the context of the opening user. Because the CVSS vector is AV:N/AC:L/PR:N/UI:R/S:U with High confidentiality, integrity, and availability impact, the flaw is remotely reachable without prior authentication or privileges, and the only practical gate is the required user interaction (UI:R) - a classic file-delivery pattern where the victim opens the weaponized document. CISA's SSVC assessment (Exploitation: none, Automatable: no, Technical Impact: total) confirms that each victim must individually open the file, which limits mass-automated propagation but does not lower the per-host severity; the assessment also notes no non-default configuration prerequisite, so the exposure is driven purely by the affected version plus user action.
Know when Powerpoint gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File delivered over network and opened by the victim yields AV:N with UI:R; no privileges needed (PR:N), and a use-after-free RCE gives full C/I/A impact in the user's context.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
Executive ViewAI
A high-severity Microsoft PowerPoint vulnerability affects organizations using Microsoft 365 Apps for Enterprise, Office LTSC 2021, Office LTSC 2024, and corresponding macOS Office builds. If an employee opens a crafted presentation, an attacker could gain control of that endpoint, creating risk of data theft, malware deployment, or operational disruption. Leadership should prioritize this because PowerPoint is widely used across business functions, and vendor patches are available to reduce exposure.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Powerpoint
View allMicrosoft Excel 2007 SP3, PowerPoint 2007 SP3, Word 2007 SP3, Excel 2010 SP2, PowerPoint 2010 SP2, and Word 2010 SP2 all
Use-after-free vulnerability in Microsoft Office 2007 SP3, Excel 2007 SP3, PowerPoint 2007 SP3, Word 2007 SP3, Office 20
Microsoft Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2, Word 2010 SP2, Office 2013 SP1, Excel 2013 SP1, PowerPoi
A remote code execution vulnerability exists in Microsoft PowerPoint when the software fails to properly handle objects
A remote code execution vulnerability exists in Microsoft PowerPoint 2007 Service Pack 3, Microsoft PowerPoint 2010 Serv
A remote code execution vulnerability exists in Microsoft PowerPoint 2016, Microsoft SharePoint Enterprise Server 2016,
Microsoft PowerPoint 2010 SP2, PowerPoint Viewer, and Office Web Apps 2010 SP2 allow remote attackers to execute arbitra
A library injection vulnerability exists in Microsoft PowerPoint 16.83 for macOS. Rated critical severity (CVSS 9.1), th
Microsoft Access 2007 SP3, Excel 2007 SP3, InfoPath 2007 SP3, OneNote 2007 SP3, PowerPoint 2007 SP3, Project 2007 SP3, P
Microsoft Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2, Word 2010 SP2, Excel 2013 SP1, PowerPoint 2013 SP1, Word
Use-after-free vulnerability in Microsoft Office PowerPoint that allows an unauthenticated local attacker to execute arb
Local code execution in Microsoft Windows Win32K GRFX (graphics) subsystem allows an attacker with low-privilege local a
Exploit-DB