CVE-2026-69632 – Microsoft Office PowerPoint Remote Code Execution Vulnerability

A use-after-free vulnerability in Microsoft Office PowerPoint could allow an unauthorized attacker to execute code by sending a specially crafted presentation. Exploitation can occur when a user opens the malicious file or it is rendered in a preview pane. The vulnerability requires no attacker privileges but does require user interaction. It is not publicly disclosed and is not reported as exploited.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: An attacker could deliver a specially crafted PowerPoint presentation that triggers the vulnerability when opened or rendered in a preview pane. Successful exploitation could execute code in the user’s context, with potentially high impact to confidentiality, integrity, and availability.

EXPLOITS: No exploitation is reported, and the vulnerability is not publicly disclosed. Exploit code maturity is rated Unproven, so the source does not confirm a public exploit, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY: CVE-2026-69632 is a use-after-free vulnerability, classified as CWE-416, in Microsoft Office PowerPoint. The flaw involves improper use of memory after it has been freed. An attacker can craft a presentation designed to trigger this condition and send it to a target. Opening the file or rendering it in a preview pane can potentially trigger remote code execution in the user’s context. The attack has network attack vector, low attack complexity, requires no attacker privileges, and requires user interaction. Successful exploitation can have high confidentiality, integrity, and availability impact.

EXPLOITABILITY: Affected products include Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Microsoft Office 2019 (32-bit and 64-bit), Office LTSC 2021 (32-bit and 64-bit), Office LTSC 2024 (32-bit and 64-bit), and Microsoft PowerPoint 2016 (32-bit and 64-bit). Exploitation requires the malicious presentation to be opened or rendered in a preview pane.

BUSINESS IMPACT: Successful exploitation could allow attacker-controlled code to run in the targeted user’s context. This creates risks to sensitive information, data integrity, and system availability. A malicious presentation sent through normal business communication could therefore become a path to compromise.

WORKAROUND: No mitigations or workarounds are identified. An official fix is identified as the remediation.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 8.8. Its low attack complexity, lack of required attacker privileges, and potential for remote code execution make prompt deployment important, even though exploitation is currently assessed as less likely and no exploitation is reported.