The CVSS 5.5 classification as 'local information disclosure' obscures the real risk profile of this vulnerability. An out-of-bounds read in Microsoft Word is not equivalent to reading a config file—Word runs with elevated privilege, maintains authenticated sessions, caches rich document state, and frequently holds credentials for connected services. The 'local' qualifier in the disclosure is operationally misleading because the actual access threshold is dramatically lower than physical console access: a macro, a socially engineered document drop, or a compromised template achieves the same process entry without ever presenting a local terminal.
The historical record is telling. This pattern—OOB read primitives in Word's document parsing—has repeatedly appeared as Stage 1 in exploitation chains that achieve remote code execution or credential dumping. CVE-2017-0199, CVE-2018-0802, and several CVEs in the 2020-2023 window all followed this trajectory. Each was initially classified as medium severity local disclosure before being weaponized. When a specific vulnerability class recurs with this frequency, the prior probability of operational exploit is not captured by an EPSS score derived from individual CVE behavior.
Technically, Word's OOB reads most reliably access memory from deprecated code paths—legacy RTF parsers, old binary format handlers, embedded OLE objects from .doc compatibility layers. These 'sediment layers' tend to have larger, less-guarded heap allocations because they aren't actively audited for modern hardening. The attack surface is known and documented from previous CVEs, which makes the 'theoretical exploit path' framing difficult to defend.
Practical guidance: treat this as a Stage 1 primitive until proven otherwise. Monitor whether this CVE appears in exploit framework updates within 90 days—that's the historical signal that has consistently preceded weaponization. Prioritize patching Word across the fleet not because this specific instance is dramatically severe, but because the pattern itself is the risk-multiplier. The gap between CVE publication and full fleet patch adoption is precisely the window where attacker knowledge of these deprecated code paths compounds. Assume that if this OOB read reaches the legacy allocation regions where prior chains have formed, it can function as an oracle for credential harvesting or as a heap grooming primitive for downstream exploitation.