This vulnerability is an out‑of‑bounds read in Microsoft Office Word that enables an unauthorized attacker to read memory contents and disclose information accessible over a network. The flaw does not provide an attacker with additional privileges; it only permits the extraction of data that may be present in the application's process space.

The flaw affects Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. All versions of these products that have not yet applied the security update are vulnerable.

The CVSS score of 6.5 places the vulnerability in the high severity range. The EPSS score is not published, so the exploitation likelihood remains unknown. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the flaw is exploitable by a remote attacker over a network, potentially allowing memory contents to be read from a running instance of Microsoft Office Word.