This vulnerability, identified as CWE-73, involves external control of file name or path in Microsoft Office Word within Microsoft 365 Apps for Enterprise. It allows an unauthorized attacker to disclose information locally by accessing files or directories that should not be accessible. The CVSS 3.1 base score is 4.3, indicating medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and confidentiality impact only. The vulnerability affects version 16.0.1 of the product. Microsoft has issued an official fix and manages remediation for this cloud service. No known exploits are reported in the wild.

An unauthorized attacker can disclose local information by exploiting external control over file names or paths in Microsoft Word files or directories. The impact is limited to confidentiality with no integrity or availability effects. The attack requires user interaction but no privileges and can be performed remotely over the network.

An official fix is available from Microsoft. Since this is a cloud service, Microsoft manages remediation server-side. Users and administrators should ensure their Microsoft 365 Apps for Enterprise are updated according to the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40421 to mitigate this vulnerability.