CVE-2026-80081 Overview
CVE-2026-80081 is a use-after-free vulnerability [CWE-416] in Microsoft Office PowerPoint that enables remote code execution. An unauthorized attacker can execute arbitrary code by convincing a user to open a crafted PowerPoint file delivered over a network. The flaw affects Microsoft 365 Apps enterprise builds on both x64 and x86 architectures. Exploitation requires user interaction but does not require prior authentication or elevated privileges.
Critical Impact
Successful exploitation grants attackers arbitrary code execution in the context of the current user, with high impact to confidentiality, integrity, and availability.
Affected Products
- Microsoft 365 Apps (Enterprise, x64)
- Microsoft 365 Apps (Enterprise, x86)
- Microsoft Office PowerPoint component within Microsoft 365 Apps
Discovery Timeline
- 2026-09-08 - CVE-2026-80081 published to the National Vulnerability Database
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-80081
Vulnerability Analysis
The vulnerability is a use-after-free condition in Microsoft Office PowerPoint. Use-after-free defects occur when a program continues to reference memory after it has been released back to the allocator. Attackers who control the freed allocation can place attacker-influenced data at that location and steer program execution when the dangling pointer is dereferenced.
The flaw is reachable through PowerPoint's document parsing logic. An attacker crafts a malicious presentation file and delivers it through email, a web download, or a shared drive. When a targeted user opens the file, PowerPoint parses the embedded objects and triggers the memory-reuse condition, resulting in code execution in the user's security context.
Because the attack vector is network-based and requires only a single click by the victim, the vulnerability is well suited for phishing campaigns targeting knowledge workers.
Root Cause
The root cause is improper object lifetime management within the PowerPoint parsing code. A pointer to a heap-allocated object remains in use after the object has been freed, allowing controlled data to occupy the same allocation and be interpreted as a valid object during subsequent operations.
Attack Vector
Exploitation is remote and requires user interaction. The attacker delivers a weaponized .pptx or related Office file to a target and induces them to open it in a vulnerable Microsoft 365 Apps installation. The Preview Pane may also expand the exposure surface in certain configurations. Refer to the Microsoft Security Update Guide for authoritative technical details.
Detection Methods for CVE-2026-80081
Indicators of Compromise
- Unexpected child processes spawned by POWERPNT.EXE, such as cmd.exe, powershell.exe, wscript.exe, or rundll32.exe.
- PowerPoint process crashes or Windows Error Reporting entries referencing access violations in Office modules.
- Outbound network connections initiated by POWERPNT.EXE to untrusted or newly observed domains.
- Creation of executable files or scheduled tasks shortly after a PowerPoint document is opened.
Detection Strategies
- Hunt for anomalous parent-child process relationships originating from Office applications, mapped to MITRE ATT&CK technique T1566.001 (Spearphishing Attachment).
- Monitor for memory-corruption crash telemetry in Office processes correlated with recently received attachments.
- Inspect email gateways and web proxies for PowerPoint files delivered from untrusted senders or newly registered domains.
Monitoring Recommendations
- Enable detailed process creation logging (Windows Event ID 4688 with command-line auditing) on endpoints running Microsoft 365 Apps.
- Forward Office telemetry, EDR process events, and email attachment metadata to a centralized analytics platform for correlation.
- Track patch deployment coverage for Microsoft 365 Apps across the estate to identify unpatched endpoints.
How to Mitigate CVE-2026-80081
Immediate Actions Required
- Apply the security update referenced in the Microsoft Security Update Guide to all Microsoft 365 Apps installations.
- Verify Microsoft 365 Apps update channels are configured for automatic updates and confirm clients have received the fixed build.
- Prioritize patching for high-risk users such as executives, finance, and personnel who routinely receive external documents.
Patch Information
Microsoft has published guidance and a security update for CVE-2026-80081 through the Microsoft Security Update Guide. Administrators should validate that Microsoft 365 Apps clients report the patched version after deployment and monitor Microsoft's advisory for updates.
Workarounds
- Open untrusted PowerPoint files in Protected View and block macros originating from the internet through Group Policy.
- Use Attack Surface Reduction rules to block Office applications from creating child processes and from injecting code into other processes.
- Filter inbound PowerPoint attachments at the email gateway from external senders, or convert them to safer formats where feasible.
# Example: enable ASR rule to block Office apps from creating child processes
Add-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
