CVE-2026-69797 is a high severity flaw in Microsoft Office PowerPoint, scored 8.8 by the record. Per the NVD record, it allows an unauthorized attacker to execute code over a network. The record does not state a fixed build, so use the Microsoft advisory for the update that applies to your version and apply it.
What's affected
The NVD record lists these affected products: 365 apps; microsoft 365; Office 2019; Office 2021; Office 2024; powerpoint.
The record describes the issue this way: Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
The record gives a CVSS 3.1 base score of 8.8 (HIGH), published 2026-09-08, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vector reads as follows. Access is over the network, attack complexity is low, and privileges required are none. A user has to take some action. Scope is unchanged. Confidentiality, integrity and availability impact are high, high and high.
Microsoft publishes fixed builds on its Security Update Guide, and that page needs a browser to render, so we could not read it automatically. Take version details from there. Where Microsoft's advisory differs from this record on severity or versions, trust the advisory and note the difference in your own tracking.
How to check if you're exposed
Find the installed Office build and update channel, then compare them to the fixed build in the advisory.
(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration').VersionToReport
In any Office app you can also open File, then Account, and read the version under About. Volume-licensed MSI installs of older suites are patched through Windows Update or your update server, so check those separately.
What to do now
- Read the Microsoft advisory and note the fixed build for your channel.
- Update Office through your usual channel and ask users to restart their Office apps.
- Until patched, treat unexpected documents from outside the company with extra care.
- Confirm the new build number on a sample of machines.
Why it matters
CWE-416 (use after free) describes a weakness where memory is used after it has been released, so the program acts on data it no longer owns.
Desktop software processes content that arrives from outside the company, such as documents, links and extensions. That makes user behavior and update discipline part of the exposure, and it is why patching speed varies so much between teams.
The record's kev field is false, so the record does not list this CVE in CISA's Known Exploited Vulnerabilities catalog, and no fetched advisory said it was exploited. That is a snapshot, not a promise, so keep watching.
Safeguard's Gold page for this CVE tracks the record, and the free in-browser scan can check dependency manifests for related issues. Reachability analysis helps with libraries, though it does not apply to operating system patches.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this CVE appear in the CISA Known Exploited Vulnerabilities list?
The record's kev field is false, so it is not listed in CISA's catalog as of the record we hold. That can change, so check the catalog if you are prioritizing.
Is the Preview Pane involved?
The record does not say. The advisory should state whether Preview Pane is an attack vector, so read it before deciding on interim controls.
Sources
- Microsoft Security Update Guide entry for CVE-2026-69797 (the page did not return readable advisory text to our automated fetch, so confirm details there)
- NVD record for CVE-2026-69797 as supplied in the Safeguard batch data
Last reviewed: 18 October 2026.
