An out‑of‑bounds read vulnerability in Microsoft Office products permits a local attacker to read memory that should be protected, exposing sensitive information. The flaw is a classic buffer overread (CWE‑125) arising from improper bounds checking during a memory read operation. While it does not lead to privilege escalation or remote code execution, the disclosed data could contain confidential user or system information stored in Office process memory.

Affected systems include Microsoft 365 Apps for Enterprise, Office 2016, Office 2019, Office 2021, Office 2024, Office for Mac 2021, Office for Mac 2024, SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. Version details are not specified beyond the product families, so all current releases of these products are potentially impacted.

The CVSS score of 5.5 indicates a moderate impact, and the EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, reinforcing its lower exploitation probability. The likely attack vector is local; a malicious user or attacker would need to run Office or open a crafted document on the affected system. Because the flaw only allows local information disclosure, the risk is primarily to confidentiality and is limited to users with local access.