The vulnerability is an out‑of‑bounds read in Microsoft Office. An attacker with local access can read memory beyond the intended buffer, potentially revealing confidential data such as credentials or personal information. The flaw is based on CWE‑125 and does not provide arbitrary code execution, but the data exposure can be significant for sensitive user data.

Microsoft Office 2019, Microsoft Office 2021, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024 are impacted. Exact affected sub‑versions are not listed, but any installation of these products could be vulnerable.

The CVSS score is 5.5, indicating a medium impact. The EPSS score is below 1%, meaning likelihood of exploitation is very low, and the vulnerability is not listed in the CISA KEV catalog. The flaw requires local access; therefore, it is most often exploitable by an on‑premises user or an attacker who has already compromised a device. There are no known public exploits, and no remote attack surface is described.