This vulnerability is a use‑after‑free flaw in Microsoft Office PowerPoint that allows an attacker to execute arbitrary code on a target machine. The flaw can be triggered from a malicious PowerPoint file delivered over a network, enabling the attacker to gain control of the system. The weakness is classified as CWE-416.

Affected software includes Microsoft 365 Apps for Enterprise, Microsoft Office 2019, Microsoft Office 2021, Microsoft Office 2024, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and Microsoft PowerPoint 2016. Specific version numbers are not listed in the advisory, so all current releases within those product families are potentially vulnerable unless patched.

The CVSS score of 8.8 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a network‑based attacker delivering a crafted PowerPoint file to a user’s machine; exploitation requires that the file is opened or processed by PowerPoint.