What is the CVSS score of EUVD-2026-22585?

EUVD-2026-22585 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Microsoft are affected by EUVD-2026-22585?

A use-after-free vulnerability in Microsoft PowerPoint (2016, 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps) allows attackers to execute arbitrary code on user machines by distributing malicious…. A patch is available.

How to fix or mitigate EUVD-2026-22585?

Within 24 hours: Inventory all PowerPoint installations across the enterprise (2016, 2019, LTSC 2021, LTSC 2024, Microsoft 365 Apps) and identify users at highest risk (executives, finance, legal, operations). Within 7 days: Deploy Microsoft Security Updates for PowerPoint via Windows Update, WSUS, or Microsoft 365 admin center; apply to all affected versions listed above. Within 30 days: Verify 100% patch deployment via endpoint management tools; conduct user awareness training on not opening unsolicited presentation attachments.

Microsoft EUVD-2026-22585

| CVE-2026-32200 HIGH

Use After Free (CWE-416)

2026-04-14 microsoft

Denial Of Service Use After Free Memory Corruption Microsoft

7.8

CVSS 3.1 · NVD

Temporal: 6.8

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

CIRCL (temporal)

6.8 MEDIUM

cvss

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 15:22 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 19:35 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 17:46 euvd

EUVD-2026-22585

Analysis Generated

Apr 14, 2026 - 17:46 vuln.today

Patch released

Apr 14, 2026 - 17:46 nvd

Patch available

CVE Published

Apr 14, 2026 - 16:58 nvd

HIGH 7.8

DescriptionCVE.org

Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.

AnalysisAI

Use-after-free memory corruption in Microsoft PowerPoint (versions 2016, 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise) enables local code execution when users open malicious files. An attacker with no privileges can achieve full system compromise (high confidentiality, integrity, and availability impact) by convincing a user to open a crafted PowerPoint document. Vendor patch available via Microsoft Security Response Center. No public exploit code or confirmed active exploitation (CISA KEV) identified at time of analysis, though CVSS 7.8 rating reflects high severity for local attack scenarios.

Technical ContextAI

This vulnerability exploits a use-after-free condition (CWE-416) in PowerPoint's document parsing engine. Use-after-free occurs when the application continues to use a memory pointer after the memory has been freed, allowing attackers to manipulate freed memory regions and redirect program execution flow. The affected products span multiple Microsoft Office product lines: PowerPoint 2016 (versions before 16.0.5548.1001), Office 2019 (19.0.0 and later requiring patch), Office LTSC 2021 and 2024 (16.0.0+ requiring patch), and Microsoft 365 Apps for Enterprise (16.0.1+ requiring patch). The memory corruption occurs during local file processing, requiring the attacker to deliver a malicious .pptx or similar document format that triggers the dangling pointer dereference during parsing or rendering operations. This class of vulnerability is particularly dangerous in document processors because complex file format parsing creates numerous opportunities for memory management errors.

RemediationAI

Apply vendor-released security updates immediately via Microsoft Update, Windows Server Update Services (WSUS), or Microsoft Endpoint Configuration Manager. For PowerPoint 2016, upgrade to version 16.0.5548.1001 or later. For Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise, install the latest security updates per guidance at https://aka.ms/OfficeSecurityReleases. Full remediation details and patch download links available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32200. As interim risk mitigation before patching, implement email attachment filtering to block unsolicited PowerPoint files, educate users to avoid opening PowerPoint documents from untrusted sources, enable Microsoft Office Protected View to open untrusted documents in read-only sandboxed mode, and consider application whitelisting controls to restrict PowerPoint execution to trusted file locations. Monitor for suspicious PowerPoint process behavior using endpoint detection and response tools.