The vulnerability is an untrusted pointer dereference in Microsoft Office PowerPoint that enables an unauthorized attacker to read internal data over a network. This flaw, described as CWE-822, allows the attacker to expose sensitive information that should be protected by the application.

The affected products are Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024. No specific version numbers are listed, but the flaw applies to all current releases of these Office packages according to the CNA.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The flaw can be exploited remotely over a network by an attacker with network access to the target system. Because the attack vector is network-bound, it can affect any system that exposes PowerPoint services to untrusted traffic.