CVE-2026-69797: Microsoft 365 Apps Use-After-Free Vulnerability

CVE-2026-69797 Overview

CVE-2026-69797 is a use-after-free vulnerability [CWE-416] in Microsoft Office PowerPoint that allows an unauthenticated attacker to execute arbitrary code over a network. Exploitation requires the target user to open a crafted PowerPoint file, giving attackers a viable path through phishing and malicious document delivery. The flaw affects multiple supported Office builds, including Microsoft 365 Apps, Office 2019, Office 2021, Office 2024, and PowerPoint 2016 on both Windows and macOS. Successful exploitation grants the attacker code execution in the context of the user running PowerPoint, enabling data theft, persistence, and lateral movement.

Critical Impact
A crafted PowerPoint document can trigger memory corruption in POWERPNT.EXE and execute attacker-controlled code with the current user's privileges.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft 365 for macOS
Microsoft Office 2019, Office 2021 LTSC, Office 2024 LTSC (Windows and macOS)
Microsoft PowerPoint 2016 (x64 and x86)

Discovery Timeline

2026-09-08 - CVE-2026-69797 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-69797

Vulnerability Analysis

The vulnerability is a use-after-free condition in Microsoft Office PowerPoint's document parsing logic. When PowerPoint processes a specifically crafted presentation, it frees a heap object but retains a dangling reference that the code later dereferences. An attacker who controls the layout of the freed memory can steer program execution to attacker-controlled data.

Exploitation follows the standard client-side document attack pattern. The attacker delivers a malicious .ppt, .pptx, or related PowerPoint file through email, chat, or a link to a hosted file. User interaction is required to open the document. Once triggered, code executes in the user's security context, providing a foothold for follow-on activity such as credential theft, ransomware staging, or command-and-control installation.

Root Cause

The root cause is improper object lifetime management in PowerPoint's parsing code [CWE-416]. A code path releases a heap allocation without invalidating existing pointers to that memory. Subsequent access reads or writes freed memory, enabling controlled memory corruption. Microsoft has not published detailed technical analysis of the affected component; see the Microsoft CVE-2026-69797 Update Guide for vendor guidance.

Attack Vector

The attack originates over the network via file delivery, but requires the victim to open the crafted PowerPoint document. Common delivery mechanisms include phishing emails with attachments, links to files hosted on SharePoint, OneDrive, or attacker-controlled infrastructure, and drive-by document downloads. No authentication to the target system is needed, and no elevated privileges are required prior to exploitation. Preview Pane rendering may also be a viable trigger depending on how the Office component processes untrusted content.

No public proof-of-concept exploit is currently listed for CVE-2026-69797. The EPSS model estimates a low but non-trivial short-term exploitation probability. Refer to the Microsoft security advisory for authoritative details.

Detection Methods for CVE-2026-69797

Indicators of Compromise

Unexpected child processes spawned by POWERPNT.EXE, such as cmd.exe, powershell.exe, wscript.exe, mshta.exe, or rundll32.exe.
PowerPoint process crashes, exception events, or Windows Error Reporting entries referencing memory access violations in POWERPNT.EXE.
Inbound PowerPoint attachments from external senders that contain embedded objects, unusual OLE streams, or references to remote templates.
Outbound network connections initiated by POWERPNT.EXE to non-Microsoft destinations shortly after a document is opened.

Detection Strategies

Hunt for parent-child process chains where Office binaries launch scripting or LOLBin interpreters, a common post-exploitation pattern for document-based RCE.
Inspect email gateways and sandboxes for PowerPoint files exhibiting anomalous structure, obfuscated content, or exploit-like heap grooming patterns.
Monitor endpoint telemetry for suspicious module loads and in-memory code execution originating from POWERPNT.EXE.

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction (ASR) rules that block Office applications from creating child processes and injecting into other processes.
Aggregate Office application crash telemetry and correlate with recent document opens to identify potential exploitation attempts.
Maintain visibility into email attachment metadata and file provenance (Mark-of-the-Web) to prioritize files delivered from untrusted sources.

How to Mitigate CVE-2026-69797

Immediate Actions Required

Apply the Microsoft security updates referenced in the Microsoft CVE-2026-69797 Update Guide across all affected Office channels on Windows and macOS.
Prioritize patching for users who routinely handle externally sourced PowerPoint files, including executive assistants, sales, marketing, and HR.
Verify Click-to-Run update status for Microsoft 365 Apps and confirm LTSC installations receive the corresponding cumulative update.

Patch Information

Microsoft has issued fixes through the standard Office update channels. Consult the Microsoft CVE-2026-69797 Update Guide for the exact build numbers and KB identifiers for Microsoft 365 Apps, Office 2019, Office 2021 LTSC, Office 2024 LTSC, and PowerPoint 2016. Enterprises using Click-to-Run should validate that update rings are current; volume-licensed installations must apply the appropriate MSP or LTSC servicing package.

Workarounds

Enforce Protected View for files originating from the internet and other untrusted locations, and disable Preview Pane rendering for Office documents in Outlook and Explorer.
Configure Office File Block policies to prevent legacy PowerPoint formats from opening, or force them into Protected View.
Deploy Attack Surface Reduction rules to block Office child-process creation and Win32 API calls from Office macros.
Restrict inbound PowerPoint attachments at the email gateway pending patch deployment, and detonate remaining files in a sandbox.

bash

# Example: enable ASR rule to block Office apps from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled

# Example: enforce Protected View via Group Policy registry keys
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f