Microsoft PowerPoint EUVD-2026-100172

Exploitation requires a user to open a maliciously crafted PowerPoint file in Microsoft Office PowerPoint (UI:R in the CVSS vector); there is no authentication requirement (PR:N). It works against default configurations of affected Office builds - including Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and the macOS Office SKUs - with no special feature toggle or privilege needed. The primary limiting factor is the mandatory user interaction: the attack fails unless the target opens the attacker-supplied document, which also makes social engineering (email attachment, shared link) the practical delivery path rather than unassisted remote compromise.

This is a genuine priority-tier vulnerability, though not an emergency. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects low-complexity, unauthenticated network-reachable code execution with full confidentiality, integrity, and availability impact - the only brake on the score is the required user interaction (UI:R), which for Office means a user must open a crafted file. No EPSS score, SSVC decision, KEV listing, or POC indicator was supplied in the input, so exploitation likelihood cannot be quantified from the data provided; status is 'no public exploit identified at time of analysis.' Signals are therefore consistent rather than conflicting, but incomplete: high technical impact is confirmed by the CVSS vector and CWE-416 (use-after-free), while real-world exploitation probability is unknown. The AV:N labeling is standard Microsoft practice for document-borne Office bugs but is effectively a file-delivery vector (email/web/share) gated by user interaction, not a wormable remote-service flaw - defenders should read it as 'open-a-malicious-file RCE,' not 'remote service RCE.' A vendor patch is available, making remediation straightforward.

An attacker emails or hosts a specially crafted PowerPoint presentation and lures a victim into opening it. Processing the malformed file triggers a use-after-free in PowerPoint, allowing the attacker to execute arbitrary code in the context of the current user. No public exploit code was identified in the provided data, and successful attack depends on the victim opening the file (UI:R).