Improper input validation in Microsoft Office PowerPoint can allow a local attacker to read sensitive information from files or the system. This flaw, identified as CWE‑20, results in a local information disclosure that can expose confidential data to any user who has access to the affected files or the system.

The vulnerability affects Microsoft 365 Apps for Enterprise, Microsoft Office 2019, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021 and Microsoft Office LTSC for Mac 2024. Specific affected versions are not disclosed in the CVE data, so it is unknown which releases are impacted.

The CVSS score of 5.5 indicates a moderate severity. The EPSS score of less than 1% suggests that exploitation is currently unlikely but not impossible. Because the flaw requires local access, an attacker who can execute malicious PowerPoint content on the target machine can trigger the disclosure. The vulnerability is not present in CISA’s KEV list, so no large‑scale exploit activity has been reported.