Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2026-69678: PowerPoint may let attackers run code remotely
CVE-2026-69678 · published 1 month ago
Summary
PowerPoint in Microsoft 365, Office 2019, Office 365 for Mac, and the 2021 and 2024 long‑term support versions contains a coding mistake that can be triggered over a network. An attacker who exploits it could run their own programs on the affected computer, potentially taking control of it or accessing data. Install the latest Microsoft updates as soon as they are available, and consider disabling automatic loading of external content until the patch is applied.
What to do
- Update microsoft microsoft 365 apps for enterprise to version 16.0.20326.20138 or later.
- Update microsoft microsoft office 2019 to version 16.0.10417.20207 or later.
- Update microsoft microsoft office ltsc 2021 to version 16.0.14334.20906 or later.
- Update microsoft microsoft office ltsc 2024 to version 16.0.17932.20976 or later.
- Update microsoft microsoft powerpoint 2016 to version 16.0.5569.1000 or later.
- Update microsoft microsoft office 365 for mac to version 16.113.26091433 or later.
- Update microsoft microsoft office ltsc for mac 2021 to version 16.113.26091433 or later.
- Update microsoft microsoft office ltsc for mac 2024 to version 16.113.26091433 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| microsoft | microsoft 365 apps for enterprise | < 16.0.20326.20138 |
| microsoft | microsoft office 2019 | < 16.0.10417.20207 |
| microsoft | microsoft office 365 for mac |
- < 16.113.26091433 |
| microsoft | microsoft office ltsc 2021 | < 16.0.14334.20906 |
| microsoft | microsoft office ltsc 2024 | < 16.0.17932.20976 |
| microsoft | microsoft office ltsc for mac 2021 |
- < 16.113.26091433 |
| microsoft | microsoft office ltsc for mac 2024 |
- < 16.113.26091433 |
| microsoft | microsoft powerpoint 2016 | < 16.0.5569.1000 |
| microsoft | 365_apps |
All versions
cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:* |
| microsoft | microsoft_365 |
All versions
cpe:2.3:a:microsoft:microsoft_365:-:*:*:*:*:macos:*:* |
| microsoft | office_2019 |
All versions
cpe:2.3:a:microsoft:office_2019:-:*:*:*:*:*:x64:* |
| microsoft | office_2021 |
All versions
cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x64:* |
| microsoft | office_2024 |
All versions
cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x64:* |
| microsoft | powerpoint |
2016 cpe:2.3:a:microsoft:powerpoint:2016:*:*:*:*:*:x64:* |
Original advisory text
Microsoft Office PowerPoint Remote Code Execution Vulnerability
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69678 vendor-advisory patch
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-416Use After Free
Timeline
Published8 Sep 2026
Updated4 Nov 2026
First seen8 Sep 2026
Track software like this
Free during beta