An out-of-bounds read flaw in Microsoft Office components allows a local attacker to read unintended memory data, leading to confidentiality exposure of sensitive information. The vulnerability, identified as CWE-125, enables reading beyond the bounds of allocated buffers when Office processes certain inputs. No remote exploitation is described; the attacker must have local access or be able to trick a user into executing a crafted file, resulting in potential disclosure of user data or configuration settings.

The flaw affects multiple Microsoft products, including Microsoft 365 Apps for Enterprise, Microsoft Office 2016, Office 2019, Office 2021, Office 2024, Office 365 for Mac, Office LTSC 2021, Office LTSC 2024 (both Windows and Mac), Office LTSC for Mac 2021, Office LTSC for Mac 2024, and SharePoint Server editions (Enterprise Server 2016, Server 2019, and Subscription Edition). All listed product versions are considered vulnerable; no exclusions are noted.

The CVSS score of 5.5 reflects moderate severity, while the EPSS score of less than 1% indicates a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The attack vector is local; an adversary requires physical or logged‑in access to trigger the out-of-bounds read, typically by opening a malicious document or otherwise forcing Office to process crafted data. Due to the low exploitation probability, the risk is moderate but still actionable as release of sensitive data is possible.