The flaw is an out‑of‑bounds read in Microsoft Office Word that lets an unauthorized attacker retrieve data from memory and transmit it over a network. This memory safety violation (CWE‑125) combined with improper input validation (CWE‑20) means that sensitive information stored on the host can be exposed if the vulnerability is exploited.

Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024 are affected. The data does not list specific build numbers, so any installation of these product lines that has not yet received the posted Microsoft update remains vulnerable.

The CVSS score of 6.5 represents moderate to high severity. EPSS information is not available, so current exploitation probability is unknown. This vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves providing Word with crafted content over a network, causing the application to read beyond bounds and send data to the attacker.