An out‑of‑bounds read within Microsoft Office Word enables an unauthorized attacker to leak sensitive data over a network. The flaw falls under CWE‑125 – accessing memory beyond buffer limits. Authentication is not required, so the vulnerability can be exercised by an external network actor. The potential impact is a compromise of confidentiality for any data accessible to the vulnerable Word instance, including document contents and possibly configuration information. Existing CVSS scoring of 6.5 indicates the attack is feasible but moderate in severity because it only yields data disclosure, not privilege escalation or denial of service.

Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024. No specific version ranges are provided, so all current releases of these products are potentially affected until Microsoft releases a fix.

The vulnerability’s CVSS score of 6.5 reflects moderate risk; exploitability may be limited by the requirement of network proximity and a successful out‑of‑bounds read. EPSS data is not available, and the issue has not been listed in the CISA KEV catalog, suggesting no widespread exploitation reports yet. The likely attack vector is remote, network‑based access to Office services, possibly via a malicious document or exploit payload sent over the network. Overall, risk is moderate but should be mitigated promptly to prevent accidental or malicious data leakage.