Microsoft Office PowerPoint: Use-after-free leads to remote code execution

Summary

A use-after-free memory flaw (CWE-416) in Microsoft Office PowerPoint allows an unauthenticated attacker to execute code remotely over a network. Per the CVE record, the attack needs no login and no user privileges, and the CVSS base score is 9.8 (critical). Sources disagree on the attack path: Microsoft describes crafted presentations processed by an Office Online service, while CrowdStrike lists the Preview Pane as a vector, so a crafted file delivered by mail, download or a web-based Office service should be treated as a plausible risk.

Affected

• Microsoft 365 Apps for Enterprise: 16.0.1 up to the October 2026 update (exact build per channel: Unknown)
• Office 365 for Mac: 1.0.0 to before 16.114.26101123
• Office LTSC 2021: 16.0.1 to before 16.0.14334.20974
• Office LTSC 2024: 16.0.0 to before 16.0.17932.21056
• Office LTSC for Mac 2021 and 2024: 16.0.1 to before 16.114.26101123 (LTSC for Mac 2024: 16.0.0 to before 16.114.26101123)

Fixed in

• Install the October 2026 security update for each channel. Exact fixed builds for Microsoft 365 Apps: Unknown; check the MSRC build matrix.
• Office LTSC 2021 and LTSC 2024: builds listed above are per the CVE record; the third-party source is unconfirmed.
• Office for Mac: status unclear. MSRC reports that the LTSC for Mac security updates are not yet immediately available, while another source reports that Microsoft is announcing their availability. Verify on MSRC.

Workaround

• No documented workaround from Microsoft. Patching is the recommended fix.
• Unverified suggestion, not from the vendor: until patched, restrict receipt of PowerPoint files from untrusted senders and consider disabling the Preview Pane for Office files.

Exploitation

• Microsoft: not publicly disclosed, not exploited, exploitability assessment 'Exploitation Less Likely'.
• CISA SSVC: exploitation none, automatable yes, technical impact total.
• Not listed in CISA KEV.
• No verified public proof-of-concept exploit found.
• Action1 reports no confirmed zero-day exploitation for this CVE.

Our recommendation

• Patch all Microsoft 365 Apps, Office LTSC and Office for Mac installations to the October 2026 build for each channel.
• Verify the build and the Mac update status on the MSRC advisory; prioritise Mac systems and any Office Online use where the status is unclear.
• Use a vulnerability scanner (for example Tenable Nessus plugin for the October 2026 PowerPoint C2R updates) to confirm missing updates.
• Filter risky file attachments at the mail gateway and monitor endpoints for unexpected PowerPoint child processes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-88178 msrc.microsoft.com
• Microsoft Security Advisory CVE-2026-88178 msrc.microsoft.com
• SentinelOne vulnerability database: CVE-2026-88178 www.sentinelone.com
• Action1: Patch Tuesday October 2026 www.action1.com
• CrowdStrike: Patch Tuesday analysis October 2026 www.crowdstrike.com
• Tenable Nessus plugin: PowerPoint C2R October 2026 updates vulners.com
• VulDB: CVE-2026-88178 vuldb.com
• OpenCVE: CVE-2026-88178 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 18:23.