An out‑of‑bounds read flaw in various Microsoft Office versions enables an attacker with local access to read memory that should not be accessible. The vulnerability directly exposes sensitive information stored in the Office application process and is classified as CWE-125. As a result, confidential documents, credentials, or other data that remain in memory at the time of exploitation could be obtained by a local user, leading to confidentiality breaches.

Microsoft Office products across the desktop ecosystem, including Microsoft 365 Apps for Enterprise, Office 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, Office 365 for Mac, Office LTSC for Mac 2021 and Office LTSC for Mac 2024, are affected. The severity applies to both Windows and macOS builds. Specific patch versions are not listed in the vendor statement, so all current releases require updating as soon as an official fix is released.

The CVSS score of 7.1 marks this vulnerability as high‑severity, though the EPSS score indicates a very low probability of exploitation today and it is not present in CISA’s KEV catalog. The weakness is exploitable only from a local context, meaning the attacker must have some execution lever such as a malicious Office document opened by the user. By reading beyond a buffer boundary, the attacker can glean contents from the Office process memory, but no direct privilege escalation or remote code execution is described.