365Fanatic / M365 Status / Security advisories / CVE-2026-69797
Microsoft Security Update Guide · Office / Microsoft 365 Apps

Microsoft Office PowerPoint Remote Code Execution Vulnerability

Microsoft · EN CVE-2026-69797 Critical Action required CVSS 8.8 Updated

Published · updated 17 sep 2026

SummaryDetailedSecurity

What does this mean?

  • Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
  • It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
  • CVSS 8.8 out of 10: high. Microsoft rates it Critical.
  • No attacks reported; Microsoft expects exploitation to be less likely.
  • What should you do? Install the security update for the version you run (or a later cumulative update):
    • Microsoft PowerPoint 2016 (32-bit edition): KB5002920 16.0.5569.1000
    • Microsoft PowerPoint 2016 (64-bit edition): KB5002920 16.0.5569.1000
    • Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.20976
    • Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
    • Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.113.26091433
    • Microsoft Office LTSC 2021 for 64-bit editions: KBRelease Notes 16.0.14334.20906

Microsoft Office PowerPoint · Remote Code Execution

Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.

Office / Microsoft 365 Apps

How do I check if I am affected?

Update the app

  • Update the app through the App Store, Google Play or the app's own automatic updates.
  • If you manage devices with Intune, check in the Intune admin center which devices still run an older version.

What kind of flaw is this?

  • CWE-416: Use After Free
    The program uses memory after it was freed (use after free), which can lead to running code.

Key facts

Released
8 sep 2026
Last revised
17 sep 2026 (v2)
Impact
Remote Code Execution
Max severity
Critical
Weakness
CWE-416: Use After Free
CVSS 3.1
8.8 / 7.7 (base / temporal)
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Publicly disclosed
No
Exploited
No
Exploitability assessment
Exploitation Less Likely
Customer action required
Yes
Links
Microsoft Security Update Guide · CVE.org

CVSS metrics

Base score metrics
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionRequired
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
Temporal score metrics
Exploit Code MaturityUnproven
Remediation LevelOfficial Fix
Report ConfidenceConfirmed

Affected products and updates

ProductUpdateBuild
Microsoft PowerPoint 2016 (32-bit edition)KB5002920 · Security Update16.0.5569.1000
Microsoft PowerPoint 2016 (64-bit edition)KB5002920 · Security Update16.0.5569.1000
Microsoft Office LTSC 2024 for 32-bit editionsKBRelease Notes16.0.17932.20976
Microsoft Office LTSC 2024 for 64-bit editionsKBRelease Notes16.0.17932.20976
Microsoft Office LTSC for Mac 2024KBRelease Notes · Security Update16.113.26091433
Microsoft Office LTSC 2021 for 64-bit editionsKBRelease Notes16.0.14334.20906
Microsoft Office LTSC for Mac 2021KBRelease Notes · Security Update16.113.26091433
Microsoft 365 Apps for Enterprise for 64-bit SystemsKBRelease Notes16.0.20326.20138
Microsoft Office LTSC 2021 for 32-bit editionsKBRelease Notes16.0.14334.20906
Microsoft Office 365 for MacKBRelease Notes · Security Update16.113.26091433
Microsoft Office 2019 for 64-bit editionsKBRelease Notes16.0.10417.20207
Microsoft 365 Apps for Enterprise for 32-bit SystemsKBRelease Notes16.0.20326.20138
Microsoft Office 2019 for 32-bit editionsKBRelease Notes16.0.10417.20207

FAQ

How could an attacker exploit this vulnerability?
An attacker could send a specially crafted presentation to a user. The vulnerability could be exploited when the file is opened or rendered in a preview pane, potentially allowing the attacker to execute code in the user's context.
Is the Preview Pane an attack vector for this vulnerability?
Yes, the Preview Pane is an attack vector.
Are the updates for Microsoft Office LTSC for Mac 2021 and 2024 currently available?
Yes. As of September 16, 2026, the security update for Microsoft Office LTSC for Mac 2021, 2024 and Microsoft Office 365 for Mac are available. Customers running Microsoft Office LTSC for Mac 2021, 2024 and Microsoft Office 365 for Mac should ensure the update is installed to be protected from this vulnerability.

Revisions

VersionDateNote
217 sep 2026Microsoft is announcing the availability of the security updates for Microsoft Office for Mac. Customers running affected Mac software should install the update for their product to be protected from this vulnerability. Customers running other Microsoft Office software do not need to take any action. See the Release Notes for more information and download links.
18 sep 2026Information published.

This is in the weekly digest for week 38 · What changed this week? →

View at Microsoft → ← All security advisories

More security advisories for Office / Microsoft 365 Apps

All advisories for Office / Microsoft 365 Apps →

Source: Microsoft Security Update Guide. 365Fanatic is not affiliated with Microsoft.