The vulnerability is an improper neutralization of input during web page generation, classified as a cross‑site scripting flaw. An attacker who can supply malicious data to the Office Out‑of‑Box Experience can cause that data to be rendered unfiltered, allowing the attacker to create forged or misleading content that appears as legitimate Office output. This can mislead users into believing the content is authentic, potentially enabling phishing or social‑engineering attacks.

The flaw affects Microsoft Office Out‑of‑Box Experience. The CVE does not enumerate specific affected versions, so any installation of Office OOBE that has not applied Microsoft’s latest update may be vulnerable.

The CVSS score of 8.2 indicates high severity, while the EPSS score of less than 1% suggests that exploitation is currently unlikely but still possible. The vulnerability is not currently listed in the CISA KEV catalog. The likely attack path requires the attacker to supply crafted content that is incorporated into the Office web page rendering process, which could be achieved over a network connection to the Office OOBE service.