CVE-2026-80081: CWE-416: Use After Free in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-80081) is a use-after-free issue classified under CWE-416 in Microsoft Office PowerPoint, part of Microsoft 365 Apps for Enterprise. It enables an attacker without privileges to execute arbitrary code remotely by exploiting the flaw over a network. The affected versions are >=16.0.1 and <16.0.20326.20138. Microsoft has published an official fix for this vulnerability, and no known exploits are currently reported in the wild. The CVSS v3.1 base score is 8.8, indicating high impact on confidentiality, integrity, and availability.

Successful exploitation allows remote code execution by an unauthorized attacker, potentially leading to full compromise of the affected system. The vulnerability impacts confidentiality, integrity, and availability with high severity.

An official fix is available from Microsoft. Users should apply the security update provided by Microsoft for Microsoft 365 Apps for Enterprise to remediate this vulnerability. Since this is a cloud service, Microsoft manages remediation for the cloud-hosted components; however, local client updates are necessary. No additional mitigation steps are indicated by the vendor advisory.