CVE-2026-69678: CWE-416: Use After Free in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CWE-416: Use After Free) exists in Microsoft Office PowerPoint as part of Microsoft 365 Apps for Enterprise. It enables remote code execution by an unauthorized attacker due to improper handling of memory, specifically use-after-free conditions. The vulnerability is exploitable over a network without privileges and requires user interaction. It has a CVSS 3.1 base score of 8.8, indicating high severity with impacts on confidentiality, integrity, and availability. Microsoft has published an official fix for affected versions and manages remediation for this cloud-hosted service.

Successful exploitation allows an attacker to execute arbitrary code remotely, potentially leading to full compromise of the affected system. The vulnerability impacts confidentiality, integrity, and availability of the affected software. No known active exploits have been reported at this time.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for Microsoft 365 Apps for Enterprise as detailed in the vendor advisory. Since this is a cloud service, Microsoft manages remediation for the hosted environment. Refer to the Microsoft Security Response Center advisory for update instructions.