An integer overflow within Microsoft Office Outlook allows an attacker to cause code execution on the target system. The flaw arises when Outlook processes specific data, leading to a wraparound that enables arbitrary code to run. The weakness is identified as CWE-190, which describes integer overflows that can exploit software control flow.

Microsoft has identified the following products as affected: Microsoft 365 Apps for Enterprise; Microsoft Office Long Term Servicing Channel 2021; Microsoft Office Long Term Servicing Channel 2024. No specific version numbers are listed in the available data, so any installation of these products at the time of release may be vulnerable.

The CVSS score of 7.5 indicates a high severity vulnerability. No EPSS score is available, so the precise likelihood of exploitation is unknown, and the vulnerability is not yet listed in the CISA KEV catalog. The impact is inferred to be remote, as the description mentions code execution over a network. Attackers would likely need to deliver a malicious document or email that Outlook processes.