CVE-2026-69678 – Microsoft Office PowerPoint Remote Code Execution Vulnerability

CVE-2026-69678 is a critical use-after-free vulnerability in Microsoft Office PowerPoint that can allow an unauthorized attacker to execute code. An attacker can send a specially crafted presentation, with exploitation occurring when a user opens the file or when it is rendered in a preview pane. Successful exploitation can execute code in the user’s context and can have a high impact on confidentiality, integrity, and availability.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: An attacker can deliver a specially crafted PowerPoint presentation over a network. Attack complexity is low and no privileges are required, although user interaction is required. Successful exploitation can result in remote code execution with high confidentiality, integrity, and availability impact.

EXPLOITS: The vulnerability is not publicly disclosed and is not identified as exploited. Exploit code maturity is Unproven, and the exploitability assessment is Exploitation Less Likely. The source does not confirm a public exploit, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY: CVE-2026-69678 is caused by a use-after-free weakness (CWE-416) in Microsoft Office PowerPoint. An attacker can create and send a specially crafted presentation to a target. When the presentation is opened or rendered in a preview pane, the memory-handling flaw can potentially be triggered and allow attacker-controlled code to execute in the user’s context. The attack vector is Network, attack complexity is Low, privileges required are None, and user interaction is Required. Successful exploitation carries high confidentiality, integrity, and availability impact.

EXPLOITABILITY: Affected products include Microsoft 365 Apps for Enterprise 32-bit and 64-bit; Microsoft Office 2019 32-bit and 64-bit; Microsoft Office LTSC 2021 32-bit and 64-bit; Microsoft Office LTSC 2024 32-bit and 64-bit; and Microsoft PowerPoint 2016 32-bit and 64-bit. Exploitation can occur when a specially crafted presentation is opened or rendered in a preview pane.

BUSINESS IMPACT: Successful exploitation could allow malicious code to execute in the user’s context, creating the potential for loss of confidentiality, unauthorized changes, and disruption to availability. A weaponized presentation could therefore turn routine document handling into a route for compromising organizational systems and information.

WORKAROUND: No mitigations or workarounds are specified. An official fix is identified, so organizations should apply the applicable update rather than rely on an unconfirmed alternative mitigation.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 8.8. Its low attack complexity, network attack vector, lack of required attacker privileges, and potential for remote code execution make prompt deployment important, even though exploitation is assessed as less likely and no exploitation is identified.