CVE-2026-88178: CWE-416: Use After Free in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-88178) is a use-after-free flaw (CWE-416) in Microsoft Office PowerPoint component of Microsoft 365 Apps for Enterprise. It enables remote code execution by an unauthenticated attacker over the network, with no user interaction required. The CVSS 3.1 score is 9.8 (critical), reflecting high impact on confidentiality, integrity, and availability. Affected versions include =16.0.1, =1.0.0, >=16.0.1 <16.0.14334.20974, >=16.0.0 <16.0.17932.21056, and =16.0.0. Microsoft has issued an official fix and manages remediation for this cloud service. No known active exploitation has been reported.

Successful exploitation allows an attacker to execute arbitrary code remotely on affected Microsoft 365 Apps for Enterprise installations, potentially leading to full system compromise. The vulnerability has high impact on confidentiality, integrity, and availability as indicated by the CVSS score of 9.8.

An official fix is available from Microsoft. Users and administrators should apply the vendor-provided updates as detailed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88178. Since this is a cloud-hosted service, Microsoft manages remediation server-side. There are no known exploits in the wild currently, but timely patching is recommended.