Buffer over‑read in Microsoft Office allows an unauthorized attacker to disclose information locally. The flaw, identified as a buffer over‑read (CWE‑126), means an attacker can read data beyond the intended buffer boundaries, potentially exposing sensitive data stored in memory.

The flaw affects multiple Office products, including Microsoft 365 Apps for Enterprise, Office 2019, Office 365 for Mac, the LTSC 2021 and LTSC 2024 releases, and LTSC for Mac 2021 and LTSC for Mac 2024 editions, and the does not list specific sub‑versions or build numbers, so all current releases of the mentioned products are potentially impacted.

The CVSS score of 4.7 indicates the% (≈ 0.00357) indicates a very low exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be local because the description states that an unauthorized local attacker can exploit the flaw; it is also inferred that a user or process with privileges sufficient to open Office documents may trigger the out‑of‑bounds read. Attackers can therefore potentially read and disclose data that resides in Office’s memory space.