Advisories
Microsoft Office for Mac PowerPoint RCE Vulnerability CVE-2026-88178 Fixed
Microsoft released a patch for a remote code execution flaw in PowerPoint on macOS. Only Mac users of affected Office versions need to update; other Office platforms are unaffected.
What happened
A flaw in Microsoft Office PowerPoint for macOS allowed remote code execution when a malicious presentation was opened. The issue is identified as CVE-2026-88178.
Impact
Only macOS users running affected Office versions are vulnerable. Windows, Linux, and other Office platforms are not impacted.
What to do
Mac users of Office should install the latest security update immediately. Other Office users can ignore this advisory. For details, consult the official Microsoft release notes.
Related vulnerabilities
Microsoft Excel for Mac RCE Vulnerability CVE-2026-81950 – Update Required
Microsoft released a security update for Office for Mac to fix a remote code execution flaw (CVE‑2026‑81950). The vulnerability affects all current Mac versions of Excel and can be triggered by malicious spreadsheets. Defenders should ensure Office for Mac is patched; other Office products are unaffected.
Read briefing
Microsoft Office for Mac RCE Vulnerability CVE‑2026‑97780 – Update Required
A remote code execution flaw (CVE‑2026‑97780) affects Microsoft Office for Mac. Users of the Mac version must install the latest security update; other Office products are unaffected. Defenders should verify that Mac installations are patched and monitor for exploitation attempts.
Read briefing
Microsoft Office for Mac RCE Vulnerability CVE-2026-88196 – Update Required
Microsoft released a patch for a remote code execution flaw (CVE-2026-88196) affecting Office for Mac. Admins should install the update immediately; other Office products are unaffected.
Read briefing
CVE‑2026‑108455: PowerPoint Information Disclosure – Update Omission Clarified
Microsoft Office PowerPoint’s information disclosure vulnerability (CVE‑2026‑108455) was fixed in the October 2026 security update, but the CVE was omitted from the advisory list. Defenders should verify the update is installed; no further action is required if already updated.
Read briefing