CVE-2026-69797 – Microsoft Office PowerPoint Remote Code Execution Vulnerability

CVE-2026-69797 is a critical remote code execution vulnerability in Microsoft Office PowerPoint caused by a use-after-free weakness (CWE-416). An unauthorized attacker can send a specially crafted presentation that may trigger the vulnerability when a user opens the file or it is rendered in a preview pane. Successful exploitation could execute code in the user’s context and result in significant confidentiality, integrity, and availability impact.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: An attacker can deliver a specially crafted PowerPoint presentation over a network. Attack complexity is low and no privileges are required, although user interaction is required. Successful exploitation can allow code execution in the user’s context, with high potential impact to confidentiality, integrity, and availability.

EXPLOITS: This vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is Unproven, and exploitation is assessed as Less Likely. The presence of public exploit code, zero-day exploitation, or proof-of-concept exploit code cannot be confirmed.

TECHNICAL SUMMARY: CVE-2026-69797 is a use-after-free vulnerability in Microsoft Office PowerPoint. The weakness occurs when software continues to use memory after it has been freed, creating an opportunity for unsafe memory operations. An attacker can craft a malicious presentation and send it to a target. Opening the presentation or rendering it in a preview pane can trigger the vulnerability and potentially allow attacker-controlled code to execute in the user’s context. The vulnerability has a network attack vector, low attack complexity, requires no attacker privileges, and requires user interaction. Successful exploitation can have high confidentiality, integrity, and availability impact.

EXPLOITABILITY: Affected products include 32-bit and 64-bit Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021, Office LTSC 2024, and PowerPoint 2016. Exploitation requires a user to open a specially crafted presentation or have it rendered in a preview pane.

BUSINESS IMPACT: Successful exploitation could allow unauthorized code execution in a user’s context, potentially exposing sensitive information, enabling unauthorized changes, and disrupting system availability. A malicious presentation can make an ordinary document workflow a path into business systems.

WORKAROUND: No workaround or mitigation is identified. An official fix is available, so affected installations should be updated.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 8.8 and can lead to remote code execution. Its low attack complexity and lack of required attacker privileges increase the risk presented by malicious presentation files. Organizations should prioritize deployment of the official fix across affected Microsoft Office and PowerPoint installations.