A flaw in Microsoft Office Outlook allows an unauthorized actor to expose sensitive information that can be used to perform spoofing over a network. The vulnerability is associated with CWE-200, which concerns information exposure. If exploited, an attacker could forge email identities or other messages, leading to phishing, credential theft, or other malicious activities that compromise confidentiality, integrity, and possibly availability of the affected systems.

The vulnerability affects a range of Microsoft products, including Microsoft 365 Apps for Enterprise, Microsoft Office 2019, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Outlook 2016, Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, and Microsoft SharePoint Server Subscription Edition. Version details are not explicitly specified in the advisory, so all releases of the listed products are potentially impacted.

The CVSS score of 7.5 indicates a high severity level. The EPSS score of less than 1% suggests a low but non-zero probability of exploitation in the wild at the time of this analysis, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves network-based interactions—an attacker can send crafted traffic to exposed Outlook or SharePoint services to trigger the information disclosure. The overall risk is moderate to high, depending on the attacker's position relative to the network and the presence of defensive controls such as email authentication and firewall rules.