The vulnerability is an out-of-bounds read in Microsoft Office Outlook that allows an unauthorized attacker to read data that should not be exposed – the description states that the attacker is unauthorized. This disclosure can occur over a network connection, potentially leaking confidential user information such as email content, attachments, or configuration data – this is inferred from the mention of "disclosure over a network." The weakness corresponds to CWE-125, indicating that boundary checks were omitted when accessing memory.

Affected products include Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. The CNA documentation does not provide specific version ranges, so organizations should treat all current releases of these products as potentially vulnerable until an update is applied.

The CVSS score of 7.5 classifies this issue as high severity, reflecting significant confidentiality impact. EPSS score of 1%, and the vulnerability is not currently listed in the CISA KEV catalog, indicating no confirmed exploits documented as of this analysis. The likely attack vector is remote, with an attacker exploiting crafted input or a malicious email to trigger the out-of-bounds read and exfiltrate data over the network – this is inferred from the mention that the vulnerability allows disclosure over a network. The vulnerability operates without authentication, allowing any user to be impacted if Outlook is running the vulnerable code – this is inferred from the description stating the attacker does not need authentication.