The vulnerability is an out‑of‑bounds read in Microsoft Office PowerPoint that allows a local attacker to read memory locations outside the intended buffer, resulting in the disclosure of sensitive information the attacker does not have authorized access to. This is a classic information‑disclosure flaw categorized as CWE‑125, where a read beyond the array or string boundary can expose confidential data.

Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024 are impacted. The CVE does not list specific revision numbers, but all current editions of these products are susceptible unless updated to a patched release that resolves this out‑of‑bounds read.

The CVSS score of 5.5 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in CISA KEV, implying no known mass exploitation yet. The attack vector is local, requiring the attacker to execute or supply a malicious PowerPoint file on the victim’s machine. Consequently, the risk is significant mainly to end users who open untrusted documents, but it does not provide remote exploitation or escalation of privileges.