The flaw is a heap-based buffer overflow that occurs when PowerPoint processes a specially crafted presentation file, allowing an attacker to execute arbitrary code locally on the affected system. The vulnerability is identified as CWE-122 and CWE-681. The consequence can be full compromise of the workstation if an attacker successfully runs code with the privileges of the logged‑in user.

Affected versions include Microsoft 365 Apps for Enterprise, Microsoft Office 2019, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and Microsoft PowerPoint 2016.

The CVSS base score of 7.8 indicates a high severity flaw with a significant impact on confidentiality, integrity, and availability. The EPSS score of less than 1% suggests that exploitation is currently unlikely, and the vulnerability is not listed in CISA's KEV catalog. Based on the description, it is inferred that the likely attack vector involves a malicious PowerPoint file opened by a user from an untrusted source, such as an email attachment or a downloaded file, which could lead to local code execution on the victim’s machine.