The CVE description states that a buffer over‑read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network, enabling the attacker to read memory contents that should not be accessible. The vulnerability is triggered when PowerPoint processes data that exceeds expected bounds, which can be exploited by interacting with the application over a network. This deficiency results in a non‑privileged attacker learning data that could compromise confidentiality.

Microsoft products affected include Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021 and 2024, and the corresponding Mac‑specific LTSC editions of 2021 and 2024. The affected releases are those prior to the published security update; no specific sub‑versions are listed, so all installations of these Office suites are considered vulnerable until the patch is applied.

The CVSS score of 6.5 indicates a moderate severity level. The EPSS score is not available, so the exploitation probability cannot be quantified, but the absence of a KEV listing suggests no widely known or active exploitation at this time. According to the updated description, the likely attack vector is over a network, meaning that remote users can trigger the vulnerability by delivering crafted content to PowerPoint. The impact is primarily confidentiality loss without evidence of code execution or privilege escalation.