An out‑of‑bounds memory read in certain Microsoft Office components enables a local attacker to access sensitive data stored in process memory. The vulnerability is classified as CWE‑126 (Buffer Overread) and grants the attacker the ability to exfiltrate confidential information with no remote interaction required.

The flaw affects multiple Office products, including Microsoft 365 Apps for Enterprise, Office 2019, Office 365 for Mac, the LTSC 2021 and LTSC 2024 releases, the LTSC for Mac 2021 and LTSC for Mac 2024 editions, and the Office for Android application. The CVE entry does not list specific sub‑versions or build numbers, so all current releases of the mentioned products are potentially impacted.

The CVSS score of 4.7 indicates low severity, and the EPSS score is not available. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires local access to the target system; a user or process with privileges sufficient to load Office documents can trigger the out‑of‑bounds read. Attackers can thus potentially read and disclose data that resides in Office’s memory space.