This vulnerability (CWE-125) involves an out-of-bounds read in Microsoft Office components within Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker to locally disclose sensitive information by reading memory outside the intended bounds. The vulnerability has a CVSS 3.1 score of 5.5, indicating medium severity, with attack vector local, low attack complexity, no privileges required, and user interaction required. Microsoft has published an official fix and manages remediation for this cloud-hosted service.

An unauthorized attacker with local access and user interaction can exploit this vulnerability to disclose sensitive information from memory. There is no impact on integrity or availability. No known exploits are currently in the wild.

Microsoft has released an official fix for this vulnerability. Since Microsoft 365 Apps for Enterprise is a cloud service, Microsoft manages the remediation server-side. Users and administrators should ensure their software is updated according to Microsoft's guidance available at the official advisory URL.