This vulnerability (CVE-2026-70325) is caused by improper input validation in Microsoft Office PowerPoint within Microsoft 365 Apps for Enterprise. It allows an unauthorized attacker to disclose information on the local system. The CVSS 3.1 score is 5.5 (medium), with attack vector local, low attack complexity, no privileges required, and user interaction required. The vulnerability impacts confidentiality but not integrity or availability. Microsoft has released an official fix and manages remediation for this cloud service. No known exploits are reported in the wild.

An attacker could locally disclose sensitive information due to improper input validation in PowerPoint. The impact is limited to confidentiality loss without affecting integrity or availability. Exploitation requires local access and user interaction, reducing the risk of remote exploitation.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should ensure their Microsoft 365 Apps for Enterprise are updated according to the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70325.