An out-of-bounds read flaw in Microsoft Office PowerPoint enables an unauthorized local adversary to read data that should be protected in memory. The weakness is a bounds-check failure (CWE‑125), allowing the application to return information from outside the intended buffer without modifying it or signaling an error. The flaw does not provide privilege escalation or system tampering; it only exposes confidential contents that the user has already accessed, such as open documents or cached credentials.

The vulnerability affects Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. These releases span both Windows and macOS platforms, covering long‑term servicing channel editions and the 365 suite that deliver Office applications to enterprises.

The CVSS base score of 5.5 indicates moderate severity. EPSS data shows an exploitation probability of less than 1%, and the vulnerability is not listed in CISA's KEV catalog, suggesting no widespread attacks to date. The attack vector is local; an attacker who can deliver a crafted PowerPoint file or run code on the victim machine can trigger the read. The impact is confined to information that the user can access locally and does not lead to a broader system compromise.