CVE-2026-69767 – Microsoft Office PowerPoint Remote Code Execution Vulnerability

CVE-2026-69767 is a critical use-after-free vulnerability in Microsoft Office PowerPoint that could allow an unauthorized attacker to execute code. Exploitation requires a user to open a specially crafted file. The attack has low complexity and requires no attacker privileges, but user interaction is required. The vulnerability can have a high impact on confidentiality, integrity, and availability.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: An attacker could create a specially crafted file and persuade a user to open it in an affected Microsoft Office or PowerPoint product. Successful exploitation could result in remote code execution, with potentially high impact to the confidentiality, integrity, and availability of the affected system.

EXPLOITS: The vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is classified as Unproven, and exploitation is assessed as Less Likely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.

TECHNICAL SUMMARY: CVE-2026-69767 is a use-after-free vulnerability, classified as CWE-416, affecting Microsoft Office PowerPoint. The vulnerability involves improper use of memory after it has been freed. An attacker can prepare a specially crafted file and must convince a user to open it to trigger the vulnerability. The attack vector is network-based, attack complexity is low, and no attacker privileges are required. Successful exploitation can execute code and produce high confidentiality, integrity, and availability impacts. An official fix is identified for the vulnerability.

EXPLOITABILITY: Affected products include Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Microsoft Office 2019 (32-bit and 64-bit), Microsoft Office LTSC 2021 (32-bit and 64-bit), Microsoft Office LTSC 2024 (32-bit and 64-bit), and Microsoft PowerPoint 2016 (32-bit and 64-bit). Exploitation requires the target user to open a specially crafted file.

BUSINESS IMPACT: Successful exploitation could allow unauthorized code execution on affected systems, potentially exposing sensitive information, altering data, and disrupting system availability. In a business environment, a malicious document could therefore become an entry point for serious compromise when opened by a user.

WORKAROUND: No workaround or mitigation is identified. An official fix is available, making patch deployment the identified remediation.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 8.8 and can lead to remote code execution with high confidentiality, integrity, and availability impact. Organizations using the affected Microsoft Office and PowerPoint products should prioritize deployment of the official fix, even though exploitation is currently assessed as less likely and no active exploitation is reported.