An out‑of‑bounds read bug in Microsoft Office Word enables an unauthorized local attacker to read memory and disclose sensitive information. The flaw is a classic CWE‑125 buffer overread that can leak data from the process, potentially exposing confidential documents or credentials stored in memory. The vulnerability does not provide remote code execution but can compromise confidentiality if the attacker is able to read data that should be protected.

Microsoft products affected include Microsoft 365 Apps for Enterprise, Microsoft Office 2019, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and Microsoft Word 2016. Version information is not explicitly listed, so the risk applies to all builds of these products that do not already contain the patch.

The CVSS score of 5.5 indicates moderate severity. No EPSS value is available, and the vulnerability is not present in the CISA KEV catalog, suggesting a lower likelihood of widespread exploitation. The attack vector is local; it requires an attacker to have access to the user’s system or to trick the user into interacting with a malicious document. Based on the description, it is inferred that exploitation would involve opening a crafted Office file that triggers the out‑of‑bounds read, allowing the attacker to dump nearby memory contents. The indirect nature of the flaw means remediation through patching is the most effective defense.