Treat this out-of-bounds read as a potential heap grooming primitive, not merely information disclosure. The CVSS 5.5 score reflects a system that scores OOB reads in isolation, but in Microsoft's threat model, Office is the premier initial access vector precisely because it executes untrusted content (macros, external content, add-ins) in rich contexts. An OOB read in that parser isn't a standalone bug — it's the memory leakage that can enable subsequent memory corruption within the same document session.
The 'locally' qualifier almost certainly means a malicious document scenario, which is a click-to-execute pathway. If the OOB read specifically exposes heap addresses or layout information, it directly accelerates a code execution chain that would otherwise require separate primitives. The patch for this class of vulnerability is almost certainly a narrow bounds check rather than a state machine refactor — fixing the symptom rather than the underlying debt. This is deliberate: Office maintains parser branches for deprecated file format features purely for backwards compatibility, and touching that legacy code carries enormous risk of breaking something. That zombie code persists in the binary, fuzzed and hardened at one seam, but otherwise intact.
Given the genealogy of Office parser OOB reads traceable to the RTF vulnerabilities of 2012-2014, treat this as part of a known exploit-enabling family rather than an isolated incident. Prioritize the patch despite the low EPSS score — the exploitability window isn't about weaponization timeline, it's about the position this vulnerability occupies in the attack chain. Monitor for subsequent CVEs in the same Office component; if you see clustering, that's the signal to escalate from patching to parser-level threat hunting.