This vulnerability (CVE-2026-63521) involves an out-of-bounds read in Microsoft Office Word, part of Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker to disclose information on the local system. The CVSS 3.1 vector indicates local attack vector with low complexity, no privileges required, user interaction needed, and high confidentiality impact without integrity or availability impact. Microsoft has published an official fix and manages remediation for this cloud service. The affected version is 16.0.1.

An attacker can exploit this vulnerability to read memory outside the intended bounds, potentially disclosing sensitive information locally. There is no impact on integrity or availability. The attack requires local access and user interaction. No known exploits are currently active in the wild.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users should ensure their Microsoft 365 Apps for Enterprise are updated to the patched version as per Microsoft's advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-63521.