This vulnerability involves an out-of-bounds read in Microsoft Office components within Microsoft 365 Apps for Enterprise. An unauthorized attacker with local access and user interaction can exploit this flaw to disclose information from memory. The CVSS 3.1 base score is 3.3, reflecting low impact on confidentiality and no impact on integrity or availability. The vulnerability is tracked as CWE-125 and has an official fix available from Microsoft. Since this is a cloud service, Microsoft manages the remediation process server-side.

The impact is limited to local information disclosure without integrity or availability effects. The attacker must have local access and require user interaction to trigger the vulnerability. There are no known exploits in the wild at this time.

An official fix is available from Microsoft, and remediation is managed by Microsoft for this cloud-hosted service. Users and administrators should ensure that Microsoft 365 Apps for Enterprise is updated according to the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45485.