An out‑of‑bounds read flaw exists in Microsoft Office Word that can be triggered by a local attacker. The bug allows the attacker to read memory contents beyond the intended buffer, resulting in the disclosure of potentially sensitive data. This vulnerability, classified as CWE‑125, leads to a local information disclosure without requiring elevated privileges.

Microsoft has identified the flaw in several Office product lines, including Microsoft 365 Apps for Enterprise, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. The affected releases are not limited to a single version; any installation of these products that has not received the latest cumulative update is potentially vulnerable.

The CVSS base score of 6.1 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting a lower likelihood of widespread exploitation. The attack vector appears to be local, meaning an attacker who has access to the user account can trigger the flaw; remote attackers cannot exploit this issue directly. Administrative mitigation through patching reduces the risk to zero.