An out-of-bounds read occurs in Microsoft Office Word when a specially crafted document is opened, allowing an attacker to execute arbitrary code locally with the privileges of the user. This result in compromise of confidentiality, integrity, and availability of the system, as the attacker could install malware, exfiltrate data, or alter system settings.

The vulnerability impacts Microsoft 365 Apps for Enterprise, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024 users. All affected versions of these products are listed in the CNA product matrix.

The flaw carries a CVSS score of 8.4, classifying it as high severity, while the EPSS score is below 1%, indicating a low current exploitation probability. It is not listed in CISA’s KEV catalog. Attackers could trigger the exploit by delivering a malicious Word document via phishing, social engineering, or unsecured downloads, leading to local code execution on the victim’s machine.