A buffer over-read flaw exists in Microsoft Office Word that allows an attacker with no authentication to read memory beyond the expected bounds and pass the resulting data to a remote location. The primary impact is the disclosure of potentially sensitive information over the network, compromising confidentiality. The weakness is classified as CWE-126, indicating that the vulnerability stems from an improper bounds check that can leak data to a remote endpoint. Based on the description, it is inferred that an attacker could trigger the flaw by manipulating a Word document or by exploiting Office’s handling of data streams while the application is running on a networked system. No exploit code or specific prerequisites are listed, but the attack vector is likely network-based.

Affected vendors and products include Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. The CVE affects all listed Microsoft Office versions under the corresponding Office 365 and LTSC channels; no granular sub-version data is provided.

The CVSS score of 6.5 places the vulnerability in the moderate severity range. The EPSS score is 0.00835, indicating a very low but non-zero exploitation probability, but the absence of a KEV designation suggests it has not yet been detected in the wild or actively exploited on a large scale. The likely attack vector is over the network, allowing an attacker to obtain disclosed data remotely. The overall risk remains significant enough to warrant timely patching but is not considered critical in the current data set.