CVE-2026-70215: Use-after-free remote code execution in Microsoft PowerPoint · ZeroHour

CVE-2026-70215

mass

Use-after-free remote code execution in Microsoft PowerPoint

CVSS 3.1

8.8 high

EPSS

—

Published

Oct 13, 2026 (3d ago)

Modified

Oct 15, 2026

AI analysis

CVE-2026-70215 is a use-after-free (CWE-416) in Microsoft Office PowerPoint that lets an unauthorized attacker run code over a network. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U with high impact on confidentiality, integrity, and availability (score 8.8), so exploitation requires a user to interact with attacker-controlled content, such as opening or previewing a malicious presentation, and does not require prior privileges. Successful exploitation can execute code in the context of the user who opened the file. Anyone running an affected PowerPoint build is in scope; the advisory data does not list exact version ranges and points to the October 2026 Microsoft security updates. It is not on the CISA Known Exploited Vulnerabilities list, and no public proof-of-concept is known.

What to do: Install Microsoft's October 2026 security updates for Office as soon as they are available for your channel, and confirm PowerPoint is no longer on an unpatched build. Until then, treat unexpected PowerPoint files and links as untrusted, and prefer Protected View or equivalent attachment controls so a document is not opened without review.

Affected

Microsoft Office PowerPoint

—

Estimated exposure

massHundreds of millions of Office installations plausibly include PowerPoint (exact vulnerable subset unknown) — Microsoft Office, including PowerPoint, is a standard component of Microsoft 365 and perpetual Office on hundreds of millions of commercial and consumer endpoints worldwide; the CVE data does not publish a vulnerable-build count, so this…

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.

Vendors: microsoft
Products: 365 apps, microsoft 365, office 2021, office 2024
Weakness: CWE-416
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (—)

CVE-2026-70215

In the news1 stories

The October 2026 Security Update Review