An out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network. The flaw is classified as CWE-125, meaning that reading memory beyond the intended bounds can reveal data that should be protected. The vulnerability could allow a compromise of confidentiality for files or data that PowerPoint processes, potentially exposing proprietary or personal details to the attacker.

Microsoft Office products affected include Microsoft 365 Apps for Enterprise, Office 365 for Mac, Office LTSC 2021, Office LTSC 2024, Office LTSC for Mac 2021 and Office LTSC for Mac 2024. All listed editions in both Windows and macOS environments are impacted in the versions specified by Microsoft.

The CVSS score of 6.5 indicates a medium impact with normal exploitation difficulty. EPSS data is not available, so the likelihood of a public exploit cannot be quantified at this time, and the vulnerability is not listed in the CISA KEV catalog. Attackers could potentially trigger the out-of-bounds read by delivering a specially crafted PowerPoint file or through network interactions that exercise vulnerable path logic, but the exact attack vector and prerequisites are not fully detailed in the advisories. Given the medium severity and lack of current exploit evidence, the risk is considered moderate but requires periodic review for new exploit development.