Improper input validation in Microsoft Word enables an unauthorized attacker to disclose information across the network, allowing the reading of confidential data that should remain hidden. The flaw represents a classic confidentiality breach classified under CWE‑20, an information‑disclosure weakness.

Affected Microsoft Office products include Office 2016, 2019, 2021, 2024 LTSC releases, the 365 Apps for Enterprise suite, and Office 365 for Mac with its 2021 and 2024 Mac LTSC versions. The vulnerability spans both Windows and macOS Word clients; no specific sub‑versions are listed, so all installations within these product families could be impacted.

The CVSS score of 6.5 indicates a moderate risk level. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, implying no confirmed widespread exploitation yet. Because no official hotfix or workaround is provided, the exposure depends on how the attacker interacts with the application—most likely through network‑based document handling or remote exploitation of the validation flaw. The lack of precise exploitation details means the likelihood is uncertain, but the potential confidentiality impact remains significant.