Introduction
Microsoft says a crafted PowerPoint presentation, opened for editing and paired with one specific Outline View action, can lead to code execution under the signed-in user's account on unpatched Office installs. Microsoft also confirms that the Preview Pane is an attack vector, and the affected range covers Microsoft 365 Apps, Office LTSC 2021 and 2024, and Office for Mac. Any organization that routinely handles presentations from outside parties should account for that combination.
Microsoft published CVE-2026-112734 on November 10, 2026, as part of that month's Patch Tuesday release. It rated the issue Important, with a CVSS 3.1 base score of 8.8 and a temporal score of 7.7, and classified the root cause as CWE-416, use after free. At publication, Microsoft reported that the vulnerability was not publicly disclosed and not exploited, and it assessed exploitation as less likely.
Technical Information
Root cause
The official description says only that a use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network. A use after free occurs when code keeps using an object after the memory backing it has been freed. Depending on how that freed memory is later reallocated and reused, this can corrupt program state or redirect execution.
Microsoft's advisory does not name the component, function, memory object, or code-level trigger. PowerPoint is closed source, so there is no public commit or diff, and Microsoft has not published a technical description of the code change.
What Microsoft does describe is the user action that reaches the bug: promoting selected paragraphs in Outline View while editing a crafted presentation. Taken together, the CWE and that trigger suggest that paragraph or text objects are being restructured during promotion while something still holds a reference to them. Treat this as an inference rather than a confirmed root cause. Without binary diffing, we cannot say whether the fix changes reference counting, object lifetime ownership, or adds a validation check.
Severity scoring
Microsoft, acting as the CNA, assigned this vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Attack Vector: Network. The attacker does not need local access.
- Attack Complexity: Low.
- Privileges Required: None. The attacker needs no account on the target system.
- User Interaction: Required. A user must open and act on the crafted file.
- Scope: Unchanged.
- Confidentiality, Integrity, Availability: High.
The temporal score of 7.7 is lower than the base score for two reasons. An official fix exists (RL:O), and exploit code maturity is Unproven (E:U). NVD lists the record as Awaiting Enrichment. The NIST assessment has not been provided yet, so the 8.8 score is Microsoft's own assessment rather than an independent NVD score.
Attack flow
Based on Microsoft's advisory, exploitation proceeds as follows:
- The attacker creates a specially crafted PowerPoint presentation.
- The attacker delivers the file to a target and persuades the user to open it for editing.
- The user promotes selected paragraphs in Outline View, which reaches the use after free.
- Successful exploitation runs attacker code with the permissions of the signed-in user. The attacker does not need an account on the affected system.
Microsoft separately confirms that the Preview Pane is an attack vector, but it does not explain the precise trigger in that path. Previewing an untrusted presentation should therefore not be treated as a safe alternative to opening it.
Patch Information
Microsoft fixed CVE-2026-112734 in the November 10, 2026 Patch Tuesday release. The MSRC advisory sets the Remediation Level to Official Fix, meaning a complete vendor fix is available as a patch or an upgrade. The fix ships in new Office builds, so the main task for defenders is confirming that every install has reached one of them.
The CVE appears under the PowerPoint heading for November 10, 2026, in both the Windows Microsoft 365 Apps release notes and the Office for Mac release notes. Five other PowerPoint CVEs are listed alongside it: CVE-2026-109487, CVE-2026-112737, CVE-2026-112738, CVE-2026-116922, and CVE-2026-120001.
Fixed builds by product
- Office LTSC 2024 (32-bit and 64-bit, Volume Licensed): 16.0.17932.21140 (Version 2408)
- Office LTSC 2021 (32-bit and 64-bit, Volume Licensed): 16.0.14334.21048 (Version 2108)
- Microsoft 365 Apps for Enterprise, Current Channel: Version 2610, Build 20527.20196
- Microsoft 365 Apps, Monthly Enterprise Channel: 2610 (20527.20194), 2609 (20430.20264), 2608 (20326.20320)
- Microsoft 365 Apps, Semi Annual Enterprise Channel: 2610 (20527.20192), 2609 (20430.20262), 2608 (20326.20318)
- Office 2024 and Office 2021 Retail: Version 2610, Build 20527.20196
- Office 365 for Mac, Office LTSC for Mac 2021 and 2024: 16.115 (Build 26110837)
For Microsoft 365 Apps, MSRC does not list a single fixed build. Instead it links to the Office security release notes, because the fixed build depends on the update channel. For every other product, the boundary in the CNA-supplied affected versions list is "less than" the build shown above, so any build at or above that boundary is patched.
How the update is delivered
- Windows Click to Run (Microsoft 365 Apps, Retail, LTSC): The update arrives through the normal Office automatic update channel, and no separate KB installer is needed. To verify, open File > Account > About PowerPoint and compare the build with the list above.
- macOS: Microsoft AutoUpdate delivers 16.115. Tenable Nessus plugin 378503 (macOS) gives the remediation as updating Office for Mac to version 16.115 or later.
- Office 2019: Office 2019 is not on the MSRC affected product list for this CVE. That list has nine rows: 32-bit and 64-bit Microsoft 365 Apps, Office LTSC 2024, and Office LTSC 2021, plus three Mac SKUs. You do not need to track down an Office 2019 build for this bug.
The sources reviewed provide no temporary workaround for use before the vendor fix is applied.
Affected Systems and Versions
NVD lists the following affected ranges and attributes them to Microsoft:
- Microsoft 365 Apps for Enterprise: from 16.0.1. The upper boundary points to Microsoft's Office Security Releases page rather than a numeric build.
- Microsoft Office 365 for Mac: from 1.0.0, below 16.115.26110837
- Microsoft Office LTSC 2021: from 16.0.1, below 16.0.14334.21048
- Microsoft Office LTSC 2024: from 16.0.0, below 16.0.17932.21140
- Microsoft Office LTSC for Mac 2021: from 16.0.1, below 16.115.26110837
- Microsoft Office LTSC for Mac 2024: from 16.0.0, below 16.115.26110837
Two conditions make an install exposed. It must be running a build in these ranges, and a user must either open a crafted presentation for editing and promote paragraphs in Outline View, or view the file through the Preview Pane.
Vendor Security History
The Cyber Safety Review Board investigated the separate 2023 Microsoft Exchange Online intrusion. The Board concluded that the intrusion was preventable and that Microsoft's security culture was inadequate and required an overhaul. It also noted that Microsoft did not detect the compromise itself before a customer reported anomalies.
Those findings concern the Exchange Online incident only. They do not establish any shared cause or shared actors with this PowerPoint vulnerability. For CVE-2026-112734, the sources reviewed name no threat actor and link it to no campaign. ZDI's November 2026 review lists the CVE with no public disclosure and no known exploitation at release.
References
- MSRC Security Update Guide: CVE-2026-112734
- NVD: CVE-2026-112734
- CVE.org record: CVE-2026-112734
- Microsoft 365 Apps security updates release notes
- Office for Mac release notes
- Microsoft Office Security Releases
- Tenable Nessus plugin 378503
- Zero Day Initiative: The November 2026 Security Update Review
- Microsoft 2025 Annual Report
- Cyber Safety Review Board: Review of the Summer 2023 Microsoft Exchange Online Intrusion
