This vulnerability (CVE-2026-70320) is classified as CWE-20: Improper Input Validation in Microsoft Office PowerPoint within Microsoft 365 Apps for Enterprise. It allows an unauthorized attacker to disclose information locally due to insufficient validation of input. The CVSS 3.1 base score is 5.5, indicating medium severity, with attack vector local, low attack complexity, no privileges required, and user interaction required. The impact is high confidentiality impact without integrity or availability impact. Microsoft has published an official fix and manages remediation for this cloud service. The affected version explicitly identified is 16.0.1.

The vulnerability allows unauthorized local information disclosure, impacting confidentiality. There is no impact on integrity or availability. The CVSS score of 5.5 reflects a medium severity level. No known exploits are currently active in the wild.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should apply the official update as provided by Microsoft in their security advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70320 to mitigate this vulnerability.