Information disclosure to remote attackers

Improper input validation in Microsoft Office Word on affected releases allows remote attackers to disclose information over a network. Microsoft's advisory, the CVE record, and NVD do not identify the vulnerable feature or input path beyond stating that Word improperly validates untrusted input, so the concrete mechanism remains undisclosed. Microsoft scores the flaw as requiring user interaction and no privileges, with confidentiality impact only and no published evidence of data modification, code execution, or service interruption.