Microsoft Office PowerPoint use-after-free lets unauthenticated attackers execute code (CVE-2026-88178)

What happened

Microsoft's advisory describes a use-after-free vulnerability in PowerPoint. The flaw can be exploited over a network with low attack complexity, requiring no privileges and no user interaction. An attacker who reaches the vulnerable component could achieve high impact on confidentiality, integrity and availability, which the CVE record describes as code execution with total technical impact.

Microsoft rates the issue Critical, matching the CVSS 3.1 score of 9.8. The CVE record's SSVC assessment lists exploitation as none, automatable as yes, and technical impact as total. No public disclosure is reported for this CVE.

Who is affected

Affected products and versions listed by Microsoft:

• Microsoft 365 Apps for Enterprise: 16.0.1 to before the current Office Security Releases update
• Microsoft Office 365 for Mac: 1.0.0 to before publication
• Microsoft Office LTSC 2021: 16.0.1 to before 16.0.14334.20974
• Microsoft Office LTSC 2024: 16.0.0 to before 16.0.17932.21056
• Microsoft Office LTSC for Mac 2021: 16.0.1 to before publication
• Microsoft Office LTSC for Mac 2024: 16.0.0 to before publication

PowerPoint is part of these Office suites. Organisations running affected versions with unpatched PowerPoint installations are exposed.

What to do now

1. Apply the Microsoft security update. Fixed releases are: Microsoft 365 Apps for Enterprise via the Office Security Releases channel; Microsoft Office LTSC 2021: 16.0.14334.20974; Microsoft Office LTSC 2024: 16.0.17932.21056; Microsoft Office 365 for Mac and Office LTSC for Mac 2021/2024 via the current published build.
2. Prioritise patching on all affected hosts, starting with those reachable from less-trusted network segments.
3. Microsoft has not published a workaround. Until the update is applied, restrict network reach to affected Office systems and monitor for suspicious Office process activity.
4. Confirm the installed build matches the fixed version for your Office channel.

How to detect it

Microsoft has not published indicators of compromise for this CVE. Given the code-execution impact, focus EDR and SIEM monitoring on unusual process behaviour, script execution, or unexpected network connections originating from Office applications.

Beyond the patch

This is a critical, automatable remote-code-execution flaw in a product that is widely present but rarely exposed to the internet; the real risk is an Office installation that has not picked up the update. Virtual CISO Services (vCISO) helps identify network-reachable and unpatched systems before attackers do, and Managed Detection & Response (MDR) provides EDR/SIEM coverage for any code execution that occurs before patching is complete.