Microsoft Office contains a type confusion flaw that makes the program handle an object of one type as if it were another. Classified as CWE‑843, the vulnerability can be abused to trigger local code execution, granting an attacker the same privileges as the user and potentially compromising confidentiality, integrity, and availability of the affected system.

Affected products include Microsoft 365 Apps for Enterprise, Microsoft Office 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, Office LTSC for Mac 2021, Office LTSC for Mac 2024, and Office for Android across multiple architectures. The CNA lists these product families but does not provide specific release qualifiers beyond the product names, so any installation from these lines is potentially vulnerable.

With a CVSS score of 8.4 the vulnerability is classified as high severity. The EPSS score of less than 1% indicates a very low current probability of exploitation, and the vulnerability is not listed in CISA's KEV catalog. Based on the description, it is inferred that the attacker must deliver a malicious Office file to a user who then opens or loads the file in an affected application. Once the type confusion is triggered, local code execution can occur, allowing the attacker to run arbitrary code with the user's privileges.