Improper input validation in Microsoft Office PowerPoint permits an unauthorized local attacker to read sensitive data. The flaw allows disclosure of confidential information when the user interacts with a crafted PowerPoint file, exposing data stored on the host machine.

Microsoft Office components on Windows and macOS, including Microsoft 365 Apps for Enterprise, Office 2019, Office 2021, Office 2024, Office 365 for Mac, Office LTSC 2021, Office LTSC 2024, Office LTSC for Mac 2021, and Office LTSC for Mac 2024, are affected.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% reflects a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog and can be exploited only from a local position, requiring the attacker to gain access to the target machine or execute malicious PowerPoint content.