CVE-2026-88144 – Microsoft Office PowerPoint Remote Code Execution Vulnerability

Microsoft has identified a critical remote code execution vulnerability in Microsoft Office PowerPoint that could allow an unauthorized attacker to execute malicious code on an affected system. The vulnerability results from a Use-After-Free (CWE-416) memory management weakness. An attacker could exploit this issue by convincing a user to open a specially crafted Office file. The PowerPoint Preview Pane is also identified as an attack vector. Successful exploitation could compromise sensitive information, enable unauthorized changes, and disrupt system availability. Although exploitation is considered less likely and no active exploitation has been reported, the vulnerability presents a significant security risk because it requires no prior attacker privileges and has low attack complexity.

CVSS SCORE: 8.8

SEVERITY: Critical

Threat

This vulnerability presents a serious security threat because attackers could execute malicious code remotely through a specially crafted Office document.

An attacker does not need an existing account or special privileges to attempt exploitation. However, user interaction is required.

The vulnerability has a network-based attack vector and low attack complexity, making malicious Office documents a potential entry point into corporate environments.

Successful exploitation could allow attackers to compromise sensitive business information, modify system data, or disrupt normal operations.

Exploits

Microsoft has classified this vulnerability as “Exploitation Less Likely.”

The vulnerability has not been publicly disclosed, and there are no reported instances of active exploitation.

Exploit code maturity is classified as Unproven, meaning the existence of working exploit code has not been established.

No confirmed public proof-of-concept (PoC) exploit or zero-day exploitation is identified.

Despite the absence of confirmed exploitation, the vulnerability remains a significant concern because of its Critical severity and potential for remote code execution.

Technical Summary

CVE-2026-88144 is a critical remote code execution vulnerability affecting Microsoft Office PowerPoint.

The vulnerability originates from a Use-After-Free (CWE-416) memory management weakness.

A Use-After-Free condition occurs when software attempts to access memory after that memory has already been released. This can cause unexpected application behavior and potentially allow attackers to execute malicious code.

An attacker could exploit this vulnerability by creating a specially crafted Office document designed to trigger the memory management weakness.

The attacker would need to deliver the malicious document to a targeted user and convince them to open it.

Microsoft has also confirmed that the PowerPoint Preview Pane is an attack vector, increasing the importance of handling untrusted Office documents carefully.

The vulnerability has the following technical characteristics:

• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Successful exploitation could allow unauthorized execution of code and potentially compromise the confidentiality, integrity, and availability of affected systems.

Microsoft has identified an official fix for this vulnerability.

Exploitability

The vulnerability affects the following Microsoft Office products:

• Microsoft 365 Apps for Enterprise (32-bit and 64-bit)
• Microsoft Office LTSC 2021 (32-bit and 64-bit)
• Microsoft Office LTSC 2024 (32-bit and 64-bit)

An attacker could attempt exploitation by sending a malicious Office document and convincing the recipient to open it.

The PowerPoint Preview Pane is also a potential attack vector.

Exploitation requires no attacker privileges, but user interaction is necessary.

Microsoft considers successful exploitation less likely.

Specific affected build numbers and fixed build numbers are not identified.

Business Impact

This vulnerability represents a significant business risk because Microsoft Office applications are commonly used across corporate environments.

A successful attack could transform an ordinary Office document into an entry point for malicious code execution.

Potential business consequences include:

• Sensitive Data Exposure: Attackers could potentially access confidential business information, financial records, or other sensitive data.
• System Compromise: Successful exploitation could allow unauthorized code execution on affected workstations.
• Operational Disruption: Compromised systems could experience instability, application failures, or interruptions to business activities.
• Data Integrity Risks: Attackers could potentially modify or damage important business information.
• Financial and Reputational Damage: Security incidents could result in investigation costs, recovery expenses, productivity losses, and reduced customer confidence.

Organizations that frequently exchange PowerPoint presentations with external parties may face additional exposure to malicious document attacks.

The combination of low attack complexity, no required attacker privileges, and high potential impact makes this vulnerability particularly concerning.

Workaround

Microsoft has not identified any official workarounds or mitigations for this vulnerability.

Until the security update can be deployed, organizations should consider these precautionary measures:

• Avoid opening PowerPoint files from unknown or untrusted sources.
• Exercise caution when previewing Office documents received from external parties.
• Use existing email security controls to identify and block suspicious attachments.
• Remind employees to report unexpected or suspicious Office documents.

These measures may reduce exposure but do not eliminate the vulnerability.

Urgency

Priority: Critical – Accelerated Patching Recommended

CVE-2026-88144 should be prioritized for security patch deployment because of its Critical severity and CVSS score of 8.8.

The vulnerability could allow attackers to execute malicious code remotely without requiring existing privileges on the targeted system.

Although Microsoft currently considers exploitation less likely and no active exploitation has been reported, the potential consequences remain significant.

The confirmed Preview Pane attack vector further increases the importance of protecting users who regularly handle Office documents.

Organizations should prioritize deploying Microsoft’s official security fix across affected Microsoft 365 Apps for Enterprise and Office LTSC installations.

Delaying this update leaves affected systems exposed to a vulnerability that could turn a malicious Office document into a serious security incident.