An uninitialized resource in Microsoft’s Graphics Component can be used by an authorized attacker to read sensitive in‑app information locally. The flaw allows the attacker to leak data that the application normally handles, representing a moderate confidentiality breach.

The vulnerability is limited to Microsoft Office for Android. No specific version numbers were disclosed, so any device running Office for Android that includes the affected Graphics Component is theoretically susceptible.

The CVSS score of 5.5 indicates moderate severity. The exploit is local and requires the attacker to be authorized on the device—either a legitimate user or someone with local access—so the overall risk is moderate. EPSS is not available and the issue is not listed in CISA’s KEV catalog, suggesting no widespread active exploitation has been documented.