A use‑after‑free flaw in Microsoft Office Word enables an unauthenticated attacker to read memory contents that should remain private, potentially exposing sensitive information to an external entity. The vulnerability is a classic use‑after‑free error (CWE‑416) and can lead to the disclosure of data over a network.

Affected products include Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, and Microsoft Office LTSC for Mac 2021 and Microsoft Office LTSC for Mac 2024. Specific patch versions are not provided in the advisory; any installation that has not yet applied the official update should be considered vulnerable.

The CVSS score of 6.5 indicates moderate severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited. The likely attack vector is remote, where an attacker could supply a crafted Office document or trigger the memory corruption condition over a network. Successful exploitation requires the victim to open a malicious document or otherwise trigger the use‑after‑free condition within Office Word. Given the available information, the primary risk is the accidental or intentional leakage of sensitive data to an unauthenticated attacker over the network.