This vulnerability, identified as CVE-2026-70319 and classified under CWE-20 (Improper Input Validation), affects Microsoft Office Word within Microsoft 365 Apps for Enterprise. It allows an unauthorized attacker to disclose information locally due to improper validation of input. The CVSS 3.1 base score is 5.5, indicating medium severity, with attack vector local, low attack complexity, no privileges required, and user interaction required. The vulnerability impacts confidentiality but not integrity or availability. Microsoft has issued an official fix and manages remediation for this cloud service. No active exploitation has been reported.

An attacker with local access and user interaction can exploit this vulnerability to disclose sensitive information on the affected system. The impact is limited to confidentiality, with no effect on integrity or availability. The medium severity score reflects the moderate risk posed by this flaw.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should apply the official update as directed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70319 to mitigate the vulnerability.