# CVE-2026-112737: Microsoft PowerPoint use after free remote code execution

Source: https://junglewise.ai/threats/cve-2026-112737-use-after-free-in-microsoft-office-powerpoint-allows-an  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-112737 · Severity: high · CVSS 8.8 · Published 2026-11-10

Microsoft Office PowerPoint contains a use-after-free vulnerability that allows an attacker to execute arbitrary code on a user's computer by sending a malicious presentation file over the network. Successful exploitation could lead to complete system compromise, including data theft, malware installation, and lateral movement within an organization. No public exploits have been reported yet, but the high severity rating indicates this is a serious threat requiring prompt patching.

Technologies: [Microsoft PowerPoint](https://junglewise.ai/threats/technologies/powerpoint). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft).

## Quick answers

**Is CVE-2026-112737 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-112737 being exploited in the wild.

**How severe is CVE-2026-112737?** High severity, with a CVSS score of 8.8, published 10 November 2026.

**Which products and versions are affected?** Microsoft PowerPoint.

**Is there a fix for CVE-2026-112737?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-112737 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-112737?** Check whether you run Microsoft PowerPoint. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A use-after-free memory corruption vulnerability exists in Microsoft PowerPoint, allowing remote code execution when processing a specially crafted presentation file. The attack vector is network-based and requires user interaction to open the malicious file. An attacker gains arbitrary code execution with the privileges of the user running PowerPoint.

## Affected products

- Microsoft PowerPoint

## Timeline

- 2026-11-10: disclosed

## References

- [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-112737](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-112737)

## Related threats

- [Microsoft PowerPoint out-of-bounds read information disclosure](https://junglewise.ai/threats/cve-2026-78513-microsoft-powerpoint-out-of-bounds-read-information-disclosure)
- [Microsoft PowerPoint out-of-bounds read allows information disclosure](https://junglewise.ai/threats/cve-2026-72977-microsoft-powerpoint-out-of-bounds-read-allows-information)
- [Microsoft PowerPoint use-after-free remote code execution](https://junglewise.ai/threats/cve-2026-69797-microsoft-powerpoint-use-after-free-remote-code-execution)
- [Microsoft Office PowerPoint improper access control spoofing](https://junglewise.ai/threats/cve-2026-41102-microsoft-office-powerpoint-improper-access-control-spoofing)
- [Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.](https://junglewise.ai/threats/cve-2026-32200-use-after-free-in-microsoft-office-powerpoint-allows-an)