Improper input validation in Microsoft Office PowerPoint can allow an unauthorized attacker to expose sensitive data stored on the victim machine. The vulnerability enables disclosure of confidential information without requiring authentication. However, it is limited to the user context in which the Office process runs, so the impact is confined to the local user’s data. The CVSS score of 5.5 indicates a moderate severity, while the EPSS score of less than 1% shows a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog.

Affected systems include Microsoft 365 Apps for Enterprise, Microsoft Office 2019, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office 2021, Microsoft Office 2024, Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. All of these installations of PowerPoint are vulnerable unless updated past the release of the patch. The specific patch version that addresses the vulnerability has not been disclosed in the provided data, so any Office installation of the listed product versions that has not been updated to the latest release may be affected.

The CVSS score of 5.5 indicates a moderate severity, the EPSS score of less than 1% shows a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The vulnerability can be exploited locally by an unauthorized attacker with the ability to run the PowerPoint application. No remote exploitation is possible from the information provided.