An out‑of‑bounds read occurs in Microsoft Office PowerPoint, allowing an attacker to read memory beyond the bounds of a buffer and disclose sensitive information to an unauthorized party. The flaw, classified as CWE‑125, does not provide code execution or state modification capabilities, but can expose the contents of a PowerPoint file or related data when an attacker delivers a specially crafted presentation over the network.

The weakness affects all Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, and the long‑term servicing channel releases of Microsoft Office LTSC 2021 and 2024, including both Windows and Mac versions. Any installed PowerPoint application that is part of these suites carries the vulnerability unless it has already been updated with the official patch from Microsoft.

The CVSS base score of 6.5 indicates a medium severity threat. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, implying no widespread or documented exploitation at this time. Attack vectors are network‑based, requiring an attacker who can supply malicious PowerPoint content to the vulnerable application. The lack of requirements for privileged access and the absence of code‑execution capability reduce the overall impact relative to higher‑severity flaws, yet the possibility of exposing sensitive information makes timely remediation important.