CVE-2026-88144

Executive Summary

CVE-2026-88144 is a use-after-free (UAF) vulnerability in Microsoft Office PowerPoint, classified under CWE-416, with a CVSS v3.1 base score of 8.8 (High). A remote, unauthenticated attacker can trigger the flaw by convincing a victim to open a crafted PowerPoint document, resulting in arbitrary code execution in the context of the victim user. The vulnerability remains unpatched as of this report — no patch evidence is available from any tracked source, and no public proof-of-concept, Nuclei template, or exploit code has been observed. The flaw is not listed in CISA KEV, and EPSS scoring has not yet been assigned by FIRST.org.

Because the CVSS vector specifies UI:R (User Interaction: Required) and AV:N (Attack Vector: Network), exploitation depends on social engineering: the attacker delivers a malicious document and the victim must open it in PowerPoint. A successful exploit yields high confidentiality, integrity, and availability impact (C:H/I:H/A:H), which in a UAF context typically indicates full process-context control — enabling payload execution, document manipulation, and potential lateral movement.

Technical Analysis

The root cause is a use-after-free (CWE-416): the PowerPoint application dereferences a memory object after it has been freed. In memory-corruption terms, this class of defect emerges when an object's lifetime is mismanaged — memory is released (freed) while one or more references to it remain live, and a subsequent access through a stale pointer reads or writes memory that may have been reallocated for an attacker-influenced or attacker-controlled purpose. The exact object, parser path, or component (e.g., a document-object model, an OLE/embedded object handler, or a rendering structure) is not specified in the available NVD description. No function names, class names, file paths, or API parameters are provided, so any component-level attribution would be speculation and is deliberately omitted here.

What can be stated from the data: the attack surface is the document-parsing and rendering pipeline of Microsoft Office PowerPoint. When PowerPoint opens a file, it parses a complex container format and instantiates in-memory representations of the document's elements. The UAF is triggered during this processing of a specially crafted file — i.e., the crafted document causes an object to be freed prematurely, and a later operation during parsing, rendering, or cleanup uses the dangling reference. The network vector (AV:N) reflects delivery of the document over a network (email, web download, or share), not a network-facing service in PowerPoint itself; the requirement for user interaction (UI:R) reflects that the victim must open the weaponized file.

The impact metrics (C:H/I:H/A:H) indicate that a successful trigger allows the attacker to read and modify data and to disrupt availability within the PowerPoint process context. In practice, a UAF of this severity is a strong candidate for arbitrary code execution: a controlled heap layout can place attacker data in the reclaimed memory, and the dangling reference then becomes an indirect-call or write primitive, leading to control-flow hijacking. However, because no public technical write-up or PoC exists, the precise exploitation technique (heap grooming strategy, mitigation bypass, or ROP/JOP chain) cannot be confirmed and is not asserted here.

No affected version range is available (AFFECTED_VERSION: UNKNOWN). Microsoft Office products are serviced via rollup updates and Click-to-Run channels, so the vulnerable scope should be determined empirically against the vendor's advisory once it is published. The absence of a vendor advisory, OSV package data, and patch diff means the vulnerable code path has not been publicly localized.

Exploitation Scenarios

The following attack chain is described strictly at the vulnerability-class level. No public PoC exists; the chain is inferred from the nature of a use-after-free in a document-parsing client application. No specific function names or endpoints are asserted because none are provided in the source intelligence.

1. Reconnaissance / target identification. The attacker identifies targets that routinely open PowerPoint attachments or download presentation files — e.g., corporate finance, marketing, and HR functions, or any role that receives decks from external parties. Because AV:N applies, delivery does not require network reachability to a service; the "attack surface" is the human recipient. The attacker may harvest email addresses from public sources or compromise a trusted sender account to raise credibility.

2. Crafting the trigger. The attacker constructs a malicious PowerPoint document that induces the use-after-free condition. At the class level, this means arranging file content so that an internal object used during parsing/rendering is released, and then arranging subsequent file content or processing steps so that the application accesses the freed object. Because the internal object and trigger conditions are unspecified, the exact malformed structure cannot be described; the defining characteristic is an object-lifetime violation driven by document content.

3. Delivery and trigger. The document is delivered over a network channel — email attachment, link to a hosted file, or a shared drive. The victim opens the file in Microsoft PowerPoint. As PowerPoint processes the document, the stale pointer is dereferenced, and the attacker gains control over the memory operation. If the attacker has groomed memory such that the freed region has been reallocated with controlled data, the dereference can be redirected to attacker-controlled execution (arbitrary code execution). Again, the specific primitive is inferred from the vulnerability class, not confirmed from a published exploit.

4. Post-exploitation impact. Given C:H/I:H/A:H, successful exploitation gives the attacker the ability to read sensitive data, modify data, and disrupt availability within the affected process context. In a typical Office client exploitation, this would mean code executes with the privileges of the victim user, enabling payload installation, credential access via the user's session, document theft, and onward movement within the environment. The victim's interaction requirement (UI:R) means exploitation is not self-executing; it depends on the user opening the crafted file.

No exploit code, Nuclei template, or public PoC was observed. There is no CISA KEV listing and no confirmed in-the-wild exploitation evidence in the provided data.

Impact Assessment

CVE-2026-88144 carries a CVSS v3.1 base score of 8.8 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The subscores indicate:

• Attack Vector (AV:N, Network): Exploitation can be initiated remotely; the malicious document can be delivered over the internet, email, or network shares.
• Attack Complexity (AC:L, Low): No special conditions or race windows are assumed; the trigger condition is reproducible given the crafted file.
• Privileges Required (PR:N, None): The attacker needs no prior account or access on the target system.
• User Interaction (UI:R, Required): The victim must open the malicious PowerPoint file.
• Scope (S:U, Unchanged): Impact is confined to the security authority of the vulnerable PowerPoint process and the user's session; no explicit scope escape is scored.
• Confidentiality/Integrity/Availability (C:H/I:H/A:H): High impact across all three, consistent with arbitrary code execution or full memory-corruption control within the process.

Business impact: enterprises with large Office deployments and users who handle external presentations face endpoint compromise risk. Because the flaw is client-side and user-interaction-gated, the blast radius is per-user rather than server-wide — but a single successful exploit can yield a foothold in the user's context, which in many environments has access to file shares, email, and SSO sessions. Blast radius scales with the number of users who open untrusted documents without sandboxing or Protected View. EPSS is not yet scored by FIRST.org; no probabilistic exploitation estimate is available. The vulnerability is not in CISA KEV, indicating no confirmed exploitation in the wild at the time of this report.

Detection Guidance

Sigma Rule

title: Suspicious Microsoft PowerPoint Child Process Execution (CVE-2026-88144 UAF Exploitation)
id: 8f3c1a2e-5b7d-4e9a-9c2f-88144a1b2c3d
status: experimental
description: Detects PowerPoint spawning uncommon child processes, consistent with client-side code execution following a use-after-free memory corruption vulnerability.
author: valtersit.com Threat Intelligence
date: 2026/01/01
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\POWERPNT.EXE'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate macros or add-ins invoking system utilities (rare)
level: high
tags:
  - attack.t1203
  - attack.execution
  - cve.2026.88144

YARA Rule

rule EXPL_Office_PowerPoint_UAF_CVE_2026_88144
{
    meta:
        description = "Detects suspicious embedded executable content and scripting indicators in Office documents that may relate to use-after-free exploitation (CVE-2026-88144)"
        author = "valtersit.com Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-88144"
        cve = "CVE-2026-88144"
        severity = "high"

    strings:
        $ppt_magic = { D0 CF 11 E0 A1 B1 1A E1 }
        $zip_magic = { 50 4B 03 04 }
        $ppt_ext  = "[Content_Types].xml" ascii wide
        $office_rel = "ppt/presentation.xml" ascii wide
        $mz       = { 4D 5A }
        $scr1     = "powershell" ascii nocase wide
        $scr2     = "WScript.Shell" ascii nocase wide
        $scr3     = "ShellExecute" ascii nocase wide

    condition:
        ($ppt_magic or ($zip_magic and $ppt_ext)) and
        $office_rel and
        (($mz at 0) or any of ($scr*))
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"EXPLOIT Possible Microsoft Office PowerPoint Use-After-Free Exploitation Outbound C2 (CVE-2026-88144)"; flow:established,to_server; content:"POST"; http_method; content:"/"; http_uri; pcre:"/\.(php|jsp|aspx?)\?[a-z0-9]{8,}/i"; threshold:type both, track by_src, count 5, seconds 60; classtype:trojan-activity; reference:cve,2026-88144; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-88144; sid:202688144; rev:1;)

Note: Because no specific exploitation network signatures exist, this rule targets post-exploitation beaconing behavior commonly observed after Office client-side compromise. It should be tuned to the environment.

Elastic Detection

process where host.os.type == "windows" and event.type == "start"
and process.parent.name : "POWERPNT.EXE"
and process.name : ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe",
                    "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe")

Splunk SPL Query

index=main sourcetype=WinEventLog:Security EventCode=4688
| search ParentProcessName="*\\POWERPNT.EXE"
| where match(NewProcessName, "(?i)(cmd|powershell|wscript|cscript|mshta|rundll32|regsvr32|certutil|bitsadmin)\.exe$")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(NewProcessName) as children
        by host, ParentProcessName, Account_Name
| sort - count

Wazuh OSSEC Rule

<group name="windows,exploit,cve-2026-88144,">
  <rule id="202688144" level="12">
    <if_sid>61603</if_sid>
    <field name="win.eventdata.parentImage">POWERPNT\.EXE$</field>
    <field name="win.eventdata.image">(cmd|powershell|wscript|cscript|mshta|rundll32|regsvr32|certutil)\.exe$</field>
    <description>CVE-2026-88144: Microsoft PowerPoint spawned a suspicious child process - possible use-after-free exploitation</description>
    <mitre>
      <id>T1203</id>
    </mitre>
    <group>exploit,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source. No vendor fix, no affected-version data, and no workarounds are published at the time of this report.

1. Immediate mitigations:

• Enforce Microsoft Defender Attack Surface Reduction (ASR) rules, particularly "Block Office applications from creating child processes," "Block Office applications from injecting code into other processes," and "Block Win32 API calls from Office macros."
• Ensure Microsoft Defender for Endpoint / modern AV is enabled with cloud-delivered protection and up-to-date signatures.
• Keep Protected View and Application Guard for Office (if licensed) enabled so untrusted documents open in a sandboxed container rather than the full PowerPoint runtime.
• Restrict inbound attachments at the email gateway and web proxy, and block or quarantine unrequested Office files with macro or embedded-object content.
• Enforce least privilege: users should not operate as local administrators, limiting the value of a client-side foothold.

2. Patch / upgrade steps:

• Monitor Microsoft's Security Update Guide and the Microsoft 365 / Office release-notes channels for a fix aligned to CVE-2026-88144, then deploy via the standard update mechanism (Click-to-Run updates for Microsoft 365 Apps, Windows Update / Microsoft Update for perpetually licensed Office builds).
• Apply the vendor patch to all affected Office channels (Current Channel, Monthly Enterprise Channel, Semi-Annual channels) and validate version consistency across the fleet.
• Because AFFECTED_VERSION is UNKNOWN, use the vendor advisory once published to scope which builds are vulnerable before prioritizing deployment.

3. Long-term hardening:

• Segment and monitor endpoints where Office processes spawn network or scripting utilities.
• Maintain a vulnerability management workflow that tracks unpatchable/unpatched client-side Office CVEs and re-evaluates them as EPSS and KEV data mature.
• Adopt document-origin trust policies and user awareness training targeting external presentation files.
• Preserve detections above as durable controls even after a patch lands, since Office UAF flaws remain a recurring exploitation class.

References

• NVD — CVE-2026-88144: https://nvd.nist.gov/vuln/detail/CVE-2026-88144
• CWE-416 (Use After Free): https://cwe.mitre.org/data/definitions/416.html
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-88144 not listed as of report generation)
• FIRST.org EPSS: https://www.first.org/epss (CVE-2026-88144 not yet scored as of report generation)
• MITRE ATT&CK T1203 — Exploitation for Client Execution: https://attack.mitre.org/techniques/T1203/

No confirmed threat actor campaigns or exploit-in-the-wild evidence were identified in the provided intelligence. No public PoC, exploit code, or Nuclei template exists for this CVE at the time of writing.