An out‑of‑bounds read flaw in Microsoft Office enables an unauthorized local attacker to read memory contents, potentially exposing sensitive data that was not intended for disclosure. The vulnerability is classified as CWE-125 and results in a breach of confidentiality within the affected system.

The flaw impacts Microsoft vendors’ Office products, including Microsoft 365 Apps for Enterprise, Office 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, Office for Mac 2021, Office for Mac 2024, and Office 365 for Mac. All variants are subject to the same local information disclosure vector.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score is unavailable and the issue is not listed in the CISA KEV catalog. The vulnerability requires local access to the machine and the ability to execute Office; therefore, an attacker must already possess user privileges or compromise the system to trigger the out‑of‑bounds read. Given the moderate CVSS and lack of widespread exploitation data, the risk is considered moderate but should be mitigated promptly.