Use‑after‑free in Microsoft Office PowerPoint permits an attacker to execute arbitrary code from a remote source, giving them the privileges of the current user and compromising confidentiality, integrity, and availability. The weakness is CWE‑416 (Use after free).

Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024 are affected. The vulnerability exists in current builds of these products; specific version ranges are not listed, so all recent releases should be considered vulnerable until patched.

The CVSS score of 8.8 indicates high severity. Although the EPSS score is not available, the high CVSS suggests significant risk; the flaw is not listed in CISA KEV yet. Likely attack vectors involve delivering a malicious PowerPoint file over the network (e.g., email, SMB share, or web download). No special prerequisites are indicated beyond having an active Office installation that processes external documents.