The CVSS 5.5 on this RTF parsing out-of-bounds read invites a shrug. Local attack vector, information disclosure impact, no public exploit—the score says move on. That's a mistake, and it's the kind of mistake that compounds across vulnerability lineages.
The word 'local' does work here that defenders shouldn't accept at face value. This isn't about console access or local privilege escalation. It requires a malicious document opened on the target machine, which for most organizations means phishing a user or compromising a shared drive. That's a substantially lower bar than traditional local exploits. But the more important reframe is what the target machine actually is: a SharePoint-synced workstation running Outlook with cloud authentication tokens in memory. Word during an active editing session holds opened email threads, embedded spreadsheet data, recently accessed file paths, and credential material for Microsoft 365 sync. The CVSS framework treats information disclosure as monolithic, but what's sitting in Word's heap when the malformed RTF triggers this over-read depends entirely on what else the user has open—which in modern enterprises is often everything.
This matters because RTF parsing in Word is legacy code that doesn't receive the same security scrutiny as core functionality. Deprecated parsing paths accumulate targeted fixes rather than architectural hardening—each CVE addresses a specific trigger condition while the underlying parser complexity remains unchanged. The same bug class reappears with different morphologies because the underlying data structures create recurring conditions for bounds violations. If this patch is narrow (a targeted fix for one malformed token sequence) rather than a broader bounds-checking overhaul, the same RTF handler likely contains unpatched trigger conditions that will surface as future CVEs scoring in the same 5.x range.
What you should do: examine what memory regions this OOB read actually accesses—whether it's a narrow adjacent read or a substantially larger over-bound. More critically, assess whether the target population has other documents open, cloud sync active, or authentication tokens cached in the Word process space when the malicious document arrives. If the over-read is narrow but positioned near session tokens or cloud state, the blast radius extends well beyond the workstation. If it's broad but positioned against routine heap metadata, the practical impact stays contained.
The EPSS score of 0.00352 reflects the 'local' attack vector in a threat model that hasn't kept pace with how deeply Word participates in enterprise sync meshes. Treat the CVSS as a data point, not a decision—your risk model should account for the memory state of the target and the mutation lineage of RTF parsing vulnerabilities, not the aggregate severity number.