Microsoft Office contains a flaw where an uninitialized resource can be read by an unauthorized user, enabling the disclosure of sensitive information over a network. The vulnerability is classified as CWE-908 and carries a CVSS score of 6.5, indicating moderate severity. The description states that the exposure occurs when no proper initialization occurs, allowing an attacker to access internal data that should not be transmitted.

The flaw affects a broad set of Office products, including Microsoft 365 Apps for Enterprise, Office 2016, Office 2019, Office 2021, Office 2024, Office 365 for Mac, Office LTSC 2021, Office 2024, and the corresponding Mac editions. All listed versions are impacted; no specific version numbers are provided, so any current installation of these products may be vulnerable.

The EPSS score is unavailable, but the vulnerability is not listed in CISA’s KEV catalog, suggesting it is not a known high‑profile exploit. The likely attack vector is remote, requiring an attacker to communicate with the Office application over a network, such as a corporate VPN or local network. Because the flaw allows data disclosure, an attacker could gain access to confidential documents or personal information. Given the moderate CVSS, the risk is significant enough to warrant patching, but the exploit’s feasibility may be limited by network defenses.