This vulnerability is a heap‑based buffer overflow in Microsoft Office PowerPoint that permits an unauthorized attacker to execute arbitrary code on a target system. The flaw arises from inadequate bounds checking when processing PowerPoint content and is classified as CWE-122, enabling remote code execution over the network when a malicious file is delivered to the victim.

The affected products include Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. No version‑specific details are provided, but all listed editions are considered vulnerable until patched.

The CVSS score of 7.5 indicates high severity, while the EPSS score is not available, leaving the precise exploitation probability uncertain. The vulnerability is not listed in the CISA KEV catalog, suggesting no documented public exploits yet. The attack vector is inferred to be remote; an attacker must deliver a malicious PowerPoint file to the target over a network connection to trigger the overflow.