This vulnerability (CVE-2026-64917) involves an out-of-bounds read in Microsoft Office Word component of Microsoft 365 Apps for Enterprise. The flaw allows unauthorized local information disclosure by reading memory outside the intended bounds. The CVSS 3.1 vector indicates low attack complexity, no privileges required, and user interaction needed, with high confidentiality impact but no integrity or availability impact. Microsoft has published an official fix and manages remediation for this cloud service. The affected version explicitly identified is 16.0.1.

An attacker can cause an out-of-bounds read condition leading to local disclosure of sensitive information. There is no impact on integrity or availability. The vulnerability requires local access and user interaction, limiting remote exploitation. No known active exploits have been reported.

An official fix is available from Microsoft. Users should apply the update provided by Microsoft for version 16.0.1 of Microsoft 365 Apps for Enterprise. Since this is a cloud service, Microsoft manages remediation server-side; verify the status via the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-64917.