An integer overflow or wraparound within Microsoft Office Outlook allows a remote attacker to execute code on the target system. The flaw also involves a buffer overflow (CWE-122) that can be triggered when Outlook processes particular data, enabling arbitrary code to run. The weaknesses are identified as CWE-190 and CWE-122, describing integer overflows and bounds-checking failures that can compromise software control flow.

Microsoft has identified the following products as affected: Microsoft 365 Apps for Enterprise, Microsoft Office Long Term Servicing Channel 2021, and Microsoft Office Long Term Servicing Channel 2024. No specific version numbers are listed in the available data, so any installation of these products at the time of release may be vulnerable.

The CVSS score of 7.5 indicates high severity. The EPSS score of <1% suggests a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The impact is inferred to be remote, as the description mentions code execution over a network. Attackers would need to deliver a malicious document or email that Outlook processes.