AI analysis
CVE-2026-88207 is a heap-based buffer overflow (CWE-122) in Microsoft PowerPoint as shipped with Microsoft 365 Apps, Microsoft 365, Office 2021, and Office 2024. An unauthorized attacker can trigger it over a network, but only with user interaction and under conditions Microsoft rates as high attack complexity (CVSS 3.1 base 7.5: AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). Successful exploitation can run the attacker's code in the context of the user who opens the malicious content, with high impact to confidentiality, integrity, and availability. Anyone who uses PowerPoint in those Office and Microsoft 365 products is in scope. It is not listed in CISA's Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known; the issue was covered in Microsoft's October 2026 Patch Tuesday review.
What to do: Install Microsoft's October 2026 security updates for Microsoft 365 Apps, Microsoft 365, Office 2021, and Office 2024 as soon as they are available. Until patched, do not open PowerPoint files from untrusted sources and prefer Protected View for files from email or the web.
Affected
| Microsoft 365 Apps | — |
| Microsoft 365 | — |
| Microsoft Office 2021 | — |
| Microsoft Office 2024 | — |
Estimated exposure
massOn the order of 100 million+ Office/Microsoft 365 users (estimate; not every install is equally exposed) — Microsoft 365 and desktop Office are ubiquitous consumer and enterprise productivity suites; public subscription and install figures put the user base well above 100 million, so a PowerPoint flaw spanning 365 Apps, Microsoft 365, Office…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.