This vulnerability (CVE-2026-70312) is caused by improper input validation in Microsoft Office PowerPoint within Microsoft 365 Apps for Enterprise. It allows an unauthorized attacker to disclose information locally. The CVSS 3.1 base score is 5.5, reflecting a medium severity with attack vector local, low attack complexity, no privileges required, user interaction required, and high confidentiality impact. Microsoft has released an official fix for this vulnerability and manages remediation for this cloud-hosted service. No known exploits are reported in the wild.

An attacker who successfully exploits this vulnerability can disclose sensitive information on the local system without requiring privileges. The confidentiality impact is high, but integrity and availability are not affected. Exploitation requires local access and user interaction.

An official fix is available from Microsoft. Users and administrators should apply the provided update from the Microsoft Security Response Center advisory to remediate this vulnerability. Since this is a cloud service, Microsoft manages remediation server-side, but applying client updates is recommended. No additional mitigation actions are indicated by the vendor.