CVE-2026-77898 – Microsoft Office PowerPoint Remote Code Execution Vulnerability

CVE-2026-77898 is a critical heap-based buffer overflow vulnerability in Microsoft Office PowerPoint that can allow an unauthorized attacker to execute code over a network. Exploitation requires no privileges but does require user interaction and has high attack complexity. Successful exploitation could have a high impact on confidentiality, integrity, and availability.

CVSS SCORE: 7.5.

SEVERITY: Critical.

THREAT: The vulnerability creates a remote code execution threat through a heap-based buffer overflow in Microsoft Office PowerPoint. An attacker needs no existing privileges, although successful exploitation requires user interaction and a deep understanding of the target system. Attack complexity is rated High, and exploitation may depend on factors such as system configuration, environment, and existing security measures.

EXPLOITS: This vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is classified as Unproven, and exploitation is assessed as Less Likely. The source does not confirm the existence of public exploit code, a zero-day exploit, or proof-of-concept code.

TECHNICAL SUMMARY: CVE-2026-77898 is caused by a heap-based buffer overflow (CWE-122) in Microsoft Office PowerPoint. The flaw can allow an unauthorized network-based attacker to execute code. The CVSS metrics indicate that no privileges are required, but user interaction is required and attack complexity is High. Successful exploitation is not guaranteed and can depend on the target environment, system configuration, and additional security controls. A successful attack can have a High impact on confidentiality, integrity, and availability.

EXPLOITABILITY: Affected products include 32-bit and 64-bit Microsoft 365 Apps for Enterprise, Microsoft Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft PowerPoint 2016. Exploitation is network-based, requires no privileges, requires user interaction, and has High attack complexity.

BUSINESS IMPACT: Successful exploitation could allow remote code execution and significantly affect the confidentiality, integrity, and availability of business systems and information. This creates the potential for unauthorized activity, data exposure or modification, and disruption of affected systems. “One successful exploit can turn a PowerPoint vulnerability into a serious business security incident.”

WORKAROUND: No mitigations or workarounds are identified. An official fix is listed as the remediation. Fixed-build information is unknown or not specified for the affected products.

URGENCY: This vulnerability is rated Critical and can result in remote code execution with High confidentiality, integrity, and availability impact. Although exploitation is assessed as Less Likely, is not publicly disclosed, and is not reported as exploited, affected Microsoft Office and PowerPoint installations should be prioritized for deployment of the official fix because no workaround or mitigation is identified.