A heap‑based buffer overflow in Microsoft Office Word allows an attacker with local access to the machine to read memory that should not be exposed. The vulnerability does not provide remote code execution or privilege escalation; it simply grants the local attacker the ability to disclose internal data. The weakness is classified as a classic buffer overflow, CWE‑122.

The flaw affects all recent Microsoft Office Word releases, including Microsoft 365 Apps for Enterprise, Office 365 for Mac, Office LTSC 2021, Office LTSC 2024, Office LTSC for Mac 2021, and Office LTSC for Mac 2024. Users running any of these editions should verify whether their installation is still vulnerable.

The assigned CVSS score of 3.3 indicates low severity and the lack of an EPSS rating or KEV listing reflects a relatively low threat surface. Attackers would need local access or credentials to exploit the buffer overflow, and the exploit is likely to be limited to the local user context. No public exploits or advanced techniques have been reported. The risk remains primarily tied to the accidental or malicious local execution of crafted content.