The vulnerability is a use‑after‑free bug in Microsoft Office PowerPoint that can cause arbitrary code execution. A memory management flaw lets an attacker trigger the bug through a malicious PowerPoint file or crafted network traffic, allowing them to run malicious code with the privileges of the launching process. The flaw falls under CWE‑416 and threatens confidentiality, integrity, and availability of affected systems.

Affected are Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. These are the long‑term servicing channel releases for Windows and macOS and are the versions targeting the current Microsoft 365 and LTSC updates that precede the patch published on the Microsoft security update guide.

The CVSS score of 8.8 indicates high severity, and the EPSS value is unknown, so the exploitation probability cannot be quantified. Microsoft has not listed this CVE in the CISA KEV catalog. It is likely that the exploit requires an attacker to deliver a crafted PowerPoint presentation or network packet to a vulnerable Office installation; therefore, defense should focus on restricting file access and ensuring timely updates.