CVE-2026-69767: Microsoft 365 Apps Use After Free Vulnerability

CVE-2026-69767 Overview

CVE-2026-69767 is a use-after-free vulnerability [CWE-416] in Microsoft Office PowerPoint that allows an unauthorized attacker to execute arbitrary code over a network. The flaw affects multiple supported Office releases, including Microsoft 365 Apps, Office 2019, Office 2021, Office 2024, and PowerPoint 2016, across Windows and macOS. Exploitation requires the target to open a crafted PowerPoint file, but no prior authentication is needed. Successful exploitation grants the attacker the same privileges as the current user, providing a foothold for lateral movement or persistence.

Critical Impact
A crafted PowerPoint document can trigger memory corruption in PowerPoint and execute attacker-supplied code with the current user's privileges on any supported Office installation.

Affected Products

Microsoft 365 Apps (Enterprise, x86 and x64)
Microsoft Office 2019, Office 2021 LTSC, and Office 2024 LTSC (Windows and macOS)
Microsoft PowerPoint 2016 (x86 and x64) and Microsoft 365 for macOS

Discovery Timeline

2026-09-08 - CVE-2026-69767 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-69767

Vulnerability Analysis

The vulnerability is a use-after-free condition [CWE-416] in the PowerPoint document parsing and rendering code path. When PowerPoint processes a specially crafted presentation, an object is freed while another reference to it remains reachable. Subsequent operations dereference the stale pointer, allowing an attacker to reuse the freed allocation with controlled data.

Exploiting this class of memory corruption typically leads to control of a function pointer or virtual table dispatch. That control redirects execution into attacker-supplied shellcode or into a return-oriented programming (ROP) chain that bypasses data execution prevention. The resulting code runs at the privilege level of the user who opened the document.

The attack scope is limited to the current user (S:U), so the initial compromise does not escalate to SYSTEM by itself. Attackers commonly pair this class of Office flaw with a follow-on privilege escalation to gain administrative control of the host.

Root Cause

The root cause is improper lifetime management of a heap-allocated object within PowerPoint's document handling logic. A reference to the object persists after free() is called, and later code paths use that dangling reference for read or write operations without validating that the object is still live.

Attack Vector

An attacker delivers a malicious .pptx, .ppt, or related PowerPoint file to a victim through email, a web download, a shared drive, or a collaboration platform. When the user opens the file in a vulnerable version of PowerPoint, the parser triggers the use-after-free during rendering or object instantiation. User interaction is required, but no credentials or prior access to the system are needed. See the Microsoft Security Update CVE-2026-69767 advisory for vendor-supplied details.

Detection Methods for CVE-2026-69767

Indicators of Compromise

PowerPoint (POWERPNT.EXE) spawning unusual child processes such as cmd.exe, powershell.exe, wscript.exe, mshta.exe, or rundll32.exe.
Unexpected outbound network connections initiated by POWERPNT.EXE shortly after a document is opened.
Crash dumps or Windows Error Reporting entries referencing access violations inside PowerPoint modules.
New executables, DLLs, or scripts written to %APPDATA%, %TEMP%, or %LOCALAPPDATA% following the opening of a .pptx or .ppt file.

Detection Strategies

Hunt for parent-child process anomalies where Office binaries spawn scripting or living-off-the-land interpreters.
Inspect email gateways and web proxies for PowerPoint attachments originating from untrusted or newly registered domains.
Correlate document open events with subsequent process creation, file write, and network activity within a short time window.

Monitoring Recommendations

Enable and forward Microsoft-Windows-Sysmon event IDs 1, 3, 7, and 11 for Office processes to a central analytics platform.
Monitor Office telemetry channels, including Attack Surface Reduction (ASR) audit events for rules that block Office child processes.
Track exceptions and crashes in POWERPNT.EXE through Windows Error Reporting to surface exploitation attempts that fail before payload execution.

How to Mitigate CVE-2026-69767

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-69767 advisory to all affected Office installations.
Instruct users to avoid opening PowerPoint files from untrusted or unexpected sources until patching is complete.
Ensure Protected View and Office Application Guard remain enabled for files originating from the internet.

Patch Information

Microsoft has issued a security update addressing CVE-2026-69767 across Microsoft 365 Apps, Office 2019, Office 2021 LTSC, Office 2024 LTSC, PowerPoint 2016, and Microsoft 365 for macOS. Consult the Microsoft Security Update CVE-2026-69767 advisory for the specific build numbers that resolve the vulnerability on each channel and platform.

Workarounds

Enforce Microsoft Defender Attack Surface Reduction rules that block Office applications from creating child processes and from injecting code into other processes.
Configure Group Policy or Intune to block macros in files downloaded from the internet and to enforce Protected View for internet, unsafe-location, and attachment files.
Use email gateway policies to strip or sandbox PowerPoint attachments from external senders when patching cannot be completed immediately.

bash

# Example: enable ASR rule to block Office apps from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled