A heap-based buffer overflow in Microsoft Office PowerPoint enables an unauthorized remote attacker to execute arbitrary code on a victim's machine via the network. The flaw arises when improperly handling certain PowerPoint content, and the overflow can be triggered without authentication. Successful exploitation would allow the attacker to gain local code execution privileges on the target system.

The vulnerability affects Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. All current releases of these products are listed as vulnerable; no specific patch versions are identified in the description.

The CVSS base score of 7.5 reflects high confidentiality, integrity, and availability impact, while the EPSS score is not available, so the probability of exploitation remains uncertain. The flaw is not listed in CISA KEV, indicating no confirmed widespread exploitation has been reported. Attackers can reach the vulnerable code via network connections that allow arbitrary PowerPoint files to be opened or processed, implying that remote, unauthenticated exploitation is possible if a malicious file is delivered to the victim's environment.