Use-after-free in Microsoft Office - CVE-2026-88178
Published: October 14, 2026
Vulnerability identifier: #VU155370
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-88178
CWE-ID: CWE-416
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to use-after-free in Microsoft Office PowerPoint when processing presentations. A remote attacker can submit a specially crafted presentation to an affected Office Online service to execute arbitrary code.
No user interaction is required. The Preview Pane is also an attack vector.
Affected software
Microsoft Office
How to mitigate CVE-2026-88178
Install security update from vendor's website.
Microsoft Office - addressed in versions 16.0.14334.20974, 16.0.17932.21056