Executive brief
Microsoft PowerPoint, a widely used presentation application, contains a use-after-free memory vulnerability that allows an attacker to execute arbitrary code on a user's computer through a malicious PowerPoint file. An attacker could exploit this vulnerability by sending a specially crafted presentation file to a target user, leading to complete system compromise without requiring any special privileges or user interaction beyond opening the file.
Technical details
A use-after-free vulnerability exists in Microsoft PowerPoint where memory is accessed after it has been freed, allowing an attacker to execute arbitrary code. The vulnerability can be exploited over the network by sending a malicious PowerPoint document that triggers the unsafe memory access. The attack requires the victim to open the crafted file but does not require any prior authentication or administrative privileges. Successful exploitation results in remote code execution with the privileges of the user running PowerPoint. A patch has been released by Microsoft to address this issue.
Affected products
- Microsoft PowerPoint
Timeline
- 2026-09-08: disclosed