A buffer over‑read in Microsoft Office Word permits an attacker to read beyond allocated memory boundaries, potentially leading to corruption and execution of arbitrary code on the compromised machine. The vulnerability can be triggered by a maliciously crafted Office document and is classified as CWE‑126, a buffer over‑read flaw that enables unauthorized local code execution.

The flaw affects a broad range of Microsoft Office products, including Microsoft 365 Apps for Enterprise, Office 2019, Office 2021, Office 2024, Office 365 for Mac, Office LTSC 2021, Office LTSC 2024, Office LTSC for Mac 2021, Office LTSC for Mac 2024, and Word 2016. All listed versions contain the vulnerable code path and are subject to the same local code execution risk.

With a CVSS score of 7.8 the vulnerability is high severity. The EPSS score is not available, and the issue is not in the CISA KEV catalog, indicating no known public exploitation to date. The likely attack vector is local; an adversary must provide a crafted Office document that a user opens, after which the buffer over‑read can be triggered. Prompt application of the vendor‑issued patch is the most effective defensive measure.