The vulnerability is an out-of-bounds read in Microsoft Office PowerPoint that permits an attacker to read sensitive data from memory and exfiltrate it over the network. This flaw can lead to partial disclosure of confidential information obtainable from the victim’s system. The weakness is a buffer over-read identified as CWE‑125.

Affected are Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024. The vulnerability applies to the listed Office at the default long‑term servicing channel and macOS implementations. The specific sub‑versions are not enumerated, but any edition that matches the listed CPEs is impacted.

The CVSS score of 6.5 reflects moderate severity. No EPSS data is available, and the vulnerability is not currently in the CISA KEV catalog, suggesting there are no known active exploits in the wild. An attacker would likely need network access to the target machine or to trick a user into opening a malicious PowerPoint file that contains crafted content. The vulnerability does not require privileged local access, so a remote, non‑privileged attacker may exploit it over the network under most configurations.