CVE-2026-69767: Microsoft Office PowerPoint Remote Code Execution Vulnerability

Rated Critical with a CVSS base score of 8.8 and a temporal score of 7.7, this vulnerability stems from a classic memory management flaw: a use-after-free condition tracked under CWE-416. Because the Preview Pane is an active attack vector and Customer action required: Yes, administrators and everyday users alike need to verify that their Office installations have reached the required fixed builds.

Vulnerability Overview and Technical Profile​

According to Microsoft's official advisory, a use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network. In CWE-416 scenarios, the application continues to reference a pointer after the underlying memory block has been deallocated. If an attacker crafts a presentation file that manipulates memory layout so malicious data occupies that freed space, PowerPoint can be tricked into executing arbitrary instructions within the context of the current user.

Here is the complete technical scorecard from the Microsoft Security Response Center (MSRC):

• CVE ID: CVE-2026-69767
• Title: Microsoft Office PowerPoint Remote Code Execution Vulnerability
• Severity: Critical
• CVSS Base Score: 8.8
• CVSS Temporal Score: 7.7
• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
• Weakness (CWE): CWE-416
• Description: Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
• Publicly disclosed: No
• Exploited: No
• Exploitation Assessment: Exploitation Less Likely
• Customer action required: Yes

Understanding the CVSS Vector and Attack Mechanics​

Why does a bug that requires user interaction still earn a Critical rating? The answer lies in the vector breakdown and the Official Advisory Facts provided by Microsoft:

1. Network Attack Vector and User Interaction (AV:N/AC:L/PR:N/UI:R): According to the CVSS metric, the attack vector is network (AV:N) and user interaction is required (UI:R). An attacker does not need prior privileges (PR:N), and the attack complexity is low (AC:L). Specifically, this attack requires a user to open a specially crafted file from the attacker to initiate remote code execution.
2. The Preview Pane Factor: Microsoft explicitly confirms in its advisory FAQ that the Preview Pane is an attack vector for this vulnerability. In practical enterprise terms, this significantly lowers the bar for social engineering. A user does not necessarily have to double-click an attachment and ignore macro warnings; merely selecting a malicious presentation in a mail client or Windows Explorer window where the Preview Pane invokes PowerPoint's parsing engine is enough to satisfy the user interaction requirement.
3. High Impact Across the Board (S:U/C:H/I:H/A:H): While the scope remains unchanged (S:U), successful exploitation grants high impact to confidentiality (C:H), integrity (I:H), and availability (A:H) within the user's security context.

Section Summary: CVE-2026-69767 is a Critical (CVSS 8.8) CWE-416 use-after-free vulnerability in Microsoft Office PowerPoint. Although it is currently assessed as "Exploitation Less Likely" with Publicly disclosed: No and Exploited: No, its ability to trigger via the Preview Pane makes timely patching essential.

Affected Products, Fixed Builds, and Remediation​

CVE-2026-69767 spans the modern Click-to-Run (C2R) Windows editions, macOS releases, and traditional MSI-based installations of PowerPoint 2016.

Regarding Mac availability, Microsoft's official advisory confirms that updates for Microsoft Office LTSC for Mac 2021 and 2024 are currently available. Specifically, as of September 16, 2026, the security update for Microsoft Office LTSC for Mac 2021, 2024 and Microsoft Office 365 for Mac are available. Customers running Microsoft Office LTSC for Mac 2021, 2024 and Microsoft Office 365 for Mac should ensure the update is installed to be protected from this vulnerability.

Below is the complete product-by-product mapping of affected software, associated Knowledge Base (KB) identifiers, and vendor fixed versions:

Section Summary: Every supported edition of Office from PowerPoint 2016 through Office LTSC 2024 and Microsoft 365 Apps requires patching. While modern Windows and Mac builds update via their respective Click-to-Run or Microsoft AutoUpdate channels, PowerPoint 2016 environments must specifically deploy KB5002920 to reach build 16.0.5569.1000.

Practical Verification and Administration Guide​

Because Microsoft Office deployments often mix standalone MSI packages, volume-licensed LTSC channels, and subscription-based Microsoft 365 Apps across Windows and macOS, verifying compliance requires checking exact build numbers rather than relying solely on Windows Update history.

1. Auditing Click-to-Run Builds on Windows​

For Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021, and Office LTSC 2024 on Windows, the installed Click-to-Run build number is recorded in the Windows Registry. IT administrators can query endpoints remotely or through configuration scripts by inspecting the VersionToReport value under HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration.

Compare the returned string against your deployed channel target:

• Microsoft 365 Apps for Enterprise (x86/x64): Must be 16.0.20326.20138 or later.
• Microsoft Office LTSC 2024 (x86/x64): Must be 16.0.17932.20976 or later.
• Microsoft Office LTSC 2021 (x86/x64): Must be 16.0.14334.20906 or later.
• Microsoft Office 2019 (x86/x64): Must be 16.0.10417.20207 or later.

Individual Windows users can check manually inside PowerPoint by navigating to File > Account and looking next to the About PowerPoint section to verify the build number, or clicking Update Options > Update Now to pull the latest security revision.

2. Verifying KB5002920 on PowerPoint 2016​

Unlike Click-to-Run releases, Microsoft PowerPoint 2016 (32-bit edition) (x86) and Microsoft PowerPoint 2016 (64-bit edition) (x64) are serviced via traditional Windows Installer patches (KB5002920). Ensure that Windows Server Update Services (WSUS), Microsoft Configuration Manager, or your third-party patch management solution has approved KB5002920, and confirm that the patched executable reaches build 16.0.5569.1000.

3. Checking macOS Office Installations​

For macOS fleets running Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021, or Microsoft Office LTSC for Mac 2024, the security update has been available since September 16, 2026. Ensure Microsoft AutoUpdate (MAU) or your mobile device management (MDM) platform has updated PowerPoint for Mac to fixed build 16.112.26090911 or later.

Section Summary: Don't guess whether an endpoint is protected—verify the exact build numbers (16.0.20326.20138, 16.0.17932.20976, 16.0.14334.20906, 16.0.10417.20207, 16.112.26090911, or 16.0.5569.1000 via KB5002920) across your Windows and Mac assets to neutralize CVE-2026-69767 before a malicious presentation lands in a user's Preview Pane.