Description
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
Published: 2026-10-13
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Patch
AI Analysis

Impact

A use‑after‑free flaw in Microsoft Office PowerPoint lets an unauthenticated attacker cause arbitrary code execution by delivering a specially crafted presentation over the network. The vulnerability can compromise confidentiality, integrity, and availability of the affected system. The weakness is identified by CWE‑416, indicating a memory management issue that can be leveraged by an attacker.

Affected Systems

The flaw affects Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021 and 2024, and Microsoft Office LTSC for Mac 2021 and 2024. All listed Office editions running on both Windows and macOS are impacted.

Risk and Exploitability

The CVSS score of 9.8 classifies this as critical. EPSS is unavailable, but the flaw is network‑reachable and exploitable by an unauthorized attacker with no prior authentication. The vulnerability is not listed in the CISA KEV catalog, yet its high severity demands immediate attention.

Generated by OpenCVE AI on October 16, 2026 at 05:59 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Microsoft Office security update for the affected version available from the Microsoft Update Catalog or Patch Tuesday releases.
  • If possible, enforce network segmentation or restrict inbound traffic to prevent the delivery of malicious PowerPoint files to vulnerable endpoints.
  • Apply least‑privilege and application whitelisting controls to limit the execution of untrusted Office macro code and reduce the risk surface.

Generated by OpenCVE AI on October 16, 2026 at 05:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 25 Oct 2026 01:15:00 +0000

Type Values Removed Values Added
First Time appeared Microsoft microsoft Office Ltsc 2021
Microsoft microsoft Office Ltsc 2024
Microsoft microsoft Office Ltsc For Mac 2021
Microsoft microsoft Office Ltsc For Mac 2024
Vendors & Products Microsoft microsoft Office Ltsc 2021
Microsoft microsoft Office Ltsc 2024
Microsoft microsoft Office Ltsc For Mac 2021
Microsoft microsoft Office Ltsc For Mac 2024

Thu, 15 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
First Time appeared Microsoft microsoft 365
CPEs cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*
cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*
cpe:2.3:a:microsoft:microsoft_365:-:*:*:*:*:macos:*:*
cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x64:*
cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x86:*
cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:macos:-:*
cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x64:*
cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x86:*
cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:macos:-:*
Vendors & Products Microsoft microsoft 365

Wed, 14 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 19:15:00 +0000

Type Values Removed Values Added
Description Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
Title Microsoft Office PowerPoint Remote Code Execution Vulnerability
First Time appeared Microsoft
Microsoft 365 Apps
Microsoft office 2021
Microsoft office 2024
Microsoft office 365
Microsoft office Macos 2021
Microsoft office Macos 2024
Weaknesses CWE-416
CPEs cpe:2.3:a:microsoft:365_apps:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:microsoft:office_2021:*:*:*:*:long_term_servicing_channel:*:*:*
cpe:2.3:a:microsoft:office_2024:*:*:*:*:long_term_servicing_channel:*:*:*
cpe:2.3:a:microsoft:office_365:*:*:*:*:*:macos:*:*
cpe:2.3:a:microsoft:office_macos_2021:*:*:*:*:*:long_term_servicing_channel:*:*
cpe:2.3:a:microsoft:office_macos_2024:*:*:*:*:*:long_term_servicing_channel:*:*
Vendors & Products Microsoft
Microsoft 365 Apps
Microsoft office 2021
Microsoft office 2024
Microsoft office 365
Microsoft office Macos 2021
Microsoft office Macos 2024
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C'}

Subscriptions

Microsoft 365 Apps Microsoft 365 Microsoft Office Ltsc 2021 Microsoft Office Ltsc 2024 Microsoft Office Ltsc For Mac 2021 Microsoft Office Ltsc For Mac 2024 Office 2021 Office 2024 Office 365 Office Macos 2021 Office Macos 2024
cve-icon MITRE

Status: PUBLISHED

Assigner: microsoft

Published:

Updated: 2026-10-31T18:06:37.344Z

Reserved: 2026-09-09T21:59:30.884Z

Link: CVE-2026-88178

cve-icon Vulnrichment

Updated: 2026-10-13T19:51:59.234Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-13T19:21:38.557

Modified: 2026-10-15T21:19:07.190

Link: CVE-2026-88178

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-24T23:15:02Z

Weaknesses