This vulnerability involves an out‑of‑bounds read in Microsoft Office Word that can be exploited by an unauthorized attacker to disclose data over a network. The resulting information leakage could expose sensitive application memory or document content. The description does not specify how the attacker must interact with Word; the likely attack vector is a remote threat that delivers a malicious Word file or network request that triggers the vulnerable code.

Affected products include Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021 and 2024, and the corresponding Mac editions. These are delivered through the listed Microsoft Office CPEs and cover both Windows and macOS platforms.

The CVSS score of 6.5 indicates moderate severity. EPSS is not available, so the exploitation probability cannot be quantified; the vulnerability is not listed in CISA KEV, so no known active exploit mandates urgency. As the flaw relies on an out‑of‑bounds read, exploitation requires the attacker to get the victim to load a malicious document or otherwise invoke the vulnerable code.