The vulnerability manifests as an out-of-bounds read in Microsoft Office Word, enabling an unauthorized attacker to read memory contents that are not intended to be accessible. This flaw allows the leaking of confidential data over a network, thereby compromising the confidentiality of the affected system.

Microsoft 365 Apps for Enterprise, Microsoft Office 2019, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and Word 2016 are all impacted. The affected range covers both Windows and macOS editions from 2016 through 2024, but specific patch-level details are not provided.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, so the exact likelihood of exploitation remains uncertain. Because the description notes the possibility of disclosing information over a network, the likely attack vector involves sending a crafted document or exploiting a remote feature to trigger the out-of-bounds read. Once exploited, the attacker can read protected memory areas, potentially exposing sensitive user data. Despite the moderate CVSS rating, the theoretical nature of the exploit has yet to be publicly demonstrated, though it should be treated with caution.