A use‑after‑free flaw in Microsoft Office Word allows an unauthorized local attacker to execute arbitrary code on the victim’s system. The vulnerability stems from improper memory management and is classified as CWE‑416. If successfully exploited, the attacker could gain the privileges of the user who opened the affected document, potentially leading to full system compromise.

Microsoft products affected include Microsoft 365 Apps for Enterprise, Microsoft Office 2019, Office LTSC 2021, Office LTSC 2024, Office LTSC for Mac 2021 and 2024, Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, and Microsoft Word 2016. Specific version ranges are not detailed in the available data, so all current releases of these products should be considered vulnerable.

The CVSS score of 7.8 indicates high severity, while the EPSS score of less than 1% suggests it is rarely seen in the wild and is not listed in the CISA KEV catalog The flaw requires a local attacker with the ability to open a crafted Office document; remote exploitation is not supported. Based on the description, it is inferred that an attacker can launch the exploit by having a user execute a malicious file, potentially escalating to broader system access if privileges are elevated.