An use‑after‑free flaw in Microsoft Outlook allows an attacker to execute arbitrary code as the victim user. The flaw can be triggered by a crafted document or attachment that causes Outlook to free memory and later reuse stale data, leading to code execution. The likely attack vector is local user interaction – opening a malicious document or attachment is inferred from the description. This vulnerability gives the attacker full control of the affected system, allowing them to read, modify, or delete data, install malware, or pivot further within the network, consistent with CWE‑416.

The flaw affects Microsoft 365 Apps for Enterprise, Microsoft Office 2019, the Long Term Servicing Channel builds of Office 2021 and 2024 (both Windows and macOS versions), Outlook and Word 2016, plus Microsoft SharePoint Enterprise Server 2016 and Microsoft SharePoint Server 2019. All versions of these products are affected unless explicitly patched, as the CNA did not provide narrower version ranges.

The CVSS score of 7.8 indicates a high risk if exploited, but the EPSS score of less than 1% suggests that exploitation attempts are currently rare. The vulnerability requires local user interaction – opening a malicious attachment – so it is less likely to be leveraged remotely. The vulnerability is not listed in CISA’s KEV catalog, indicating no confirmed public exploits. Nonetheless, the potential impact warrants timely remediation.