Microsoft 365 Apps For Enterprise EUVD-2026-22585

The victim must open a crafted PowerPoint file (.pptx, .ppt, or related format) in Microsoft Office PowerPoint. A local attacker or remote attacker who can deliver the malicious file can trigger the use-after-free vulnerability during file parsing, leading to local code execution.

Real-world risk is moderate-to-high with important contextual limitations. The CVSS score of 7.8 reflects high technical impact (complete confidentiality, integrity, and availability compromise) but requires local access (AV:L) and user interaction (UI:R). Attack complexity is low (AC:L) and requires no privileges (PR:N), meaning any user who can be social-engineered into opening a malicious file is vulnerable. EPSS data not provided, but typical use-after-free vulnerabilities in widely-deployed office software attract attacker interest due to prevalence in enterprise environments. No CISA KEV listing indicates no confirmed active exploitation campaigns at analysis time. No public proof-of-concept code identified, reducing immediate automated exploitation risk. However, Microsoft Office remains a high-value target for espionage and ransomware operators who routinely weaponize document-based vulnerabilities. The requirement for user interaction (opening a malicious file) makes this primarily a phishing/social engineering vector rather than a wormable network threat. Organizations using affected PowerPoint versions face tangible risk from targeted attacks, particularly via email attachments or malicious downloads. Patch availability from Microsoft mitigates risk significantly for organizations with effective patch management, but the wide deployment footprint of Office products means vulnerable instances will persist in environments with slower update cycles.

An attacker crafts a malicious PowerPoint file containing specially formatted objects that trigger use-after-free conditions during document parsing. The attacker delivers this file via phishing email, malicious website download, or compromised shared network drive. When the victim opens the document in a vulnerable PowerPoint version, the parser attempts to access freed memory, allowing the attacker to execute arbitrary code with the victim's privileges, potentially leading to malware installation, credential theft, or lateral movement within the network.