The vulnerability is an out‑of‑bounds read in Microsoft Office Word that can be exploited by an unauthorized attacker to expose data over a network. This flaw is classified as CWE‑125 and execution but allows leakage of sensitive information from the memory of the Word process.

The flaw is present in Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, and the Long‑Term Servicing Channel editions of Microsoft Office for 2021 and 2024 on both Windows and macOS. The affected installations include LTSC 2021, LTSC 2024, and their macOS equivalents.

The CVSS score of 6.5 indicates moderate severity, while the lack of an EPSS rating suggests no known widespread exploitation. Because the issue is an information disclosure rather than a denial or RCE, the likelihood of compromise depends on the attacker’s ability to trigger the out‑of‑bounds read. With unrestricted network access to vulnerable Office installations, an attacker could potentially read arbitrary memory contents and exfiltrate information. No authentication is required, making it a remote, network‑based threat.