A use‑after‑free flaw in Microsoft Word allows an attacker to execute arbitrary code locally on a system that processes a malicious document. The vulnerability is a classic CWE‑416 issue that can compromise the confidentiality and integrity of the host environment, potentially enabling privilege escalation if Word runs with elevated rights.

Affected products include Microsoft 365 Apps for Enterprise, Microsoft Office 2019, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, and Microsoft Word 2016. Specific version details were not supplied; the vulnerability exists across the listed Office and SharePoint releases.

The CVSS score of 7 indicates a high severity vulnerability, while the EPSS score of less than 1% suggests low to moderate exploitation likelihood at present. Yet the flaw remains critical because it can be triggered by a local document, which attackers can obtain via phishing or compromised sites. The vulnerability is not listed in CISA's KEV catalog, but its presence in widely deployed Microsoft products makes the impact significant for enterprises that have not yet applied the official fix.