This vulnerability (CVE-2026-70322) in Microsoft Office PowerPoint within Microsoft 365 Apps for Enterprise is due to improper input validation (CWE-20). It allows an unauthorized attacker to disclose information locally when a user interacts with a crafted input. The CVSS 3.1 vector indicates low attack complexity, no privileges required, user interaction needed, and a high impact on confidentiality without affecting integrity or availability. Microsoft has published an official fix and manages remediation for this cloud service.

An attacker can cause local information disclosure without requiring privileges, potentially exposing sensitive data on the affected system. The integrity and availability of the system are not impacted. The attack requires user interaction, limiting the attack vector to scenarios where a user is tricked into triggering the vulnerability.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should ensure their Microsoft 365 Apps for Enterprise are updated according to the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70322.