An out-of-bounds read vulnerability (CWE-125) exists in Microsoft Office Word component of Microsoft 365 Apps for Enterprise version 16.0.1. This vulnerability allows unauthorized local attackers to read memory beyond allocated boundaries, potentially disclosing sensitive information. The CVSS 3.1 base score is 6.1, reflecting medium severity with local attack vector, low attack complexity, no privileges required, and user interaction needed. The vulnerability impacts confidentiality but not integrity. Microsoft has published an official fix and manages remediation for this cloud-hosted service. No known exploits have been reported.

The vulnerability allows unauthorized local attackers to read memory outside intended boundaries, leading to potential information disclosure. The impact is limited to confidentiality loss; integrity is not affected. Availability impact is rated high in CVSS but the description does not elaborate on this. No known active exploitation has been reported.

An official fix is available from Microsoft. Since Microsoft 365 Apps for Enterprise is a cloud service, Microsoft manages remediation server-side. Users should ensure their applications are updated to the latest version as per Microsoft's advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33822 to address this vulnerability.