This vulnerability allows an unauthorized user to read files or directories that are accessible to external parties within Microsoft Office Word applications. The flaw exposes local data that should remain confidential, resulting in a breach of confidentiality consistent with CWE-552.

Microsoft products affected by this issue include Microsoft 365 Apps for Enterprise, Microsoft Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft Word 2016. Specific version information is not provided in the current data set.

The CVSS score of 5.5 indicates a medium severity risk. The EPSS score is not available and the vulnerability is not listed in CISA KEV, suggesting low to moderate exploitation likelihood. The description indicates that files or directories accessible to external parties in Word can be read by an unauthorized attacker locally. It is not explicitly stated whether remote exploitation is possible; based on the wording, it is inferred that an attacker would need local or shared‑network access to the vulnerable files. Therefore, the risk is primarily confined to environments where file permissions or external sharing settings are misconfigured.