The vulnerability arises from improper neutralization of escape, meta, or control sequences within Microsoft 365 Word Copilot. An unauthorized attacker can exploit this flaw to send sensitive data over the network, exposing confidential information. This flaw corresponds to the Access Control Weakness CWE‑150, directly impacting the confidentiality of user data.

The flaw affects Microsoft 365 Word Copilot components across all supported platforms; specific version details are not disclosed, so all installations of Word Copilot may be impacted.

The issue carries a CVSS score of 7.4, indicating high severity, yet the EPSS score of less than 1% reflects a very low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, and no known workaround exists. The likely attack vector involves the use of malicious control sequences in a Word document processed by Copilot, enabling an attacker to read or transmit data over the network.