This vulnerability (CVE-2026-83951) involves a buffer over-read in Microsoft Office Word, part of Microsoft 365 Apps for Enterprise. It allows an unauthorized attacker to disclose information locally by reading beyond the intended buffer boundaries. The CVSS 3.1 base score is 5.5, reflecting medium severity with high confidentiality impact but no integrity or availability impact. The vulnerability affects version 16.0.1 of the product. Microsoft has issued an official fix and manages remediation for the cloud service components. No active exploitation has been reported.

An attacker can cause a buffer over-read in Microsoft Office Word, potentially leading to local information disclosure. The impact is limited to confidentiality with no effect on integrity or availability. The vulnerability requires local access and user interaction. No known active exploitation exists.

An official fix is available from Microsoft for this vulnerability. Users should apply the update to version 16.0.1 or later as provided in the Microsoft security update guide. For cloud service components of Microsoft 365 Apps for Enterprise, Microsoft manages remediation server-side. No additional action is required beyond applying the official fix.