The vulnerability is a use‑after‑free flaw in Microsoft Office Word that lets an attacker execute code locally. An attacker who can place a malicious document into a target environment can trigger the flaw when the document is processed, leading to arbitrary code execution on the victim machine. The flaw compromises confidentiality, integrity and availability of the affected workstation, and can be leveraged to gain persistent footholds.

The flaw affects several Microsoft products, including Microsoft 365 Apps for Enterprise, Microsoft Office 2019, Microsoft Office LTSC editions of 2021 and 2024 (both Windows and Mac), Microsoft Word 2016, and SharePoint Server 2016 and 2019. Version numbers are not specified in the advisory; the affected configurations are all current releases of these products.

The CVSS v3 score is 7.8, indicating significant impact. The EPSS score is less than 1%, suggesting exploitation probability is currently low, and it is not listed in CISA KEV. Based on the description, the likely attack vector is local file execution: an attacker must supply a crafted Office file that the user opens or that triggers the processing engine. No network exposure is described, so exploitation is limited to environments where a user can be tricked or induced to open the malicious document.