The vulnerability stems from credentials that are not sufficiently protected within Microsoft Office. When an attacker can obtain or replicate those credentials, they can conduct spoofing activities over the network, masquerading as a legitimate user or process. This can enable the attacker to trick other systems into accepting their traffic, potentially giving them unauthorized access or the ability to read or modify data that should be protected.

The flaw impacts multiple Microsoft Office families. The affected products are Microsoft 365 Apps for Enterprise, Microsoft Office 2016, Microsoft Office 2019, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024. No specific version range is listed, so any installation of these products that has not received the relevant security update should be considered vulnerable.

The CVSS score of 6.5 positions the flaw in the medium severity bracket, suggesting that while the attack may not be trivial, it carries considerable risk if exploited. No EPSS score is available, and the vulnerability is not currently listed in CISA's KEV catalog, indicating that there is no documented exploitation yet. The reported attack vector involves network traffic, implying that an adversary with network access or the ability to send packets to Office clients could trigger the spoofing. Given the lack of publicly known exploits, the likelihood of immediate exploitation remains uncertain, but any environment that relies on Office communications should treat this as a potential threat.