A heap-based buffer overflow flaw in Microsoft Office Access enables an attacker to run arbitrary code by delivering a malicious payload to a vulnerable application over the network. Exploitation of the overflow could give an attacker the same privileges as the source user, allowing them to launch malware, exfiltrate data, or pivot to other systems. This vulnerability is classified as CWE-122 and is rated with a CVSS score of 8.8, indicating a high severity risk to affected organizations.

The flaw affects Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024. Version details are not specified in the current advisory. Users of these products should verify whether they are running a vulnerable release.

The CVSS score of 8.8 reflects significant risk. The EPSS score is not available, but the lack of a KEV listing suggests no confirmed widespread exploitation at the time of this advisory. Based on the description, it is inferred that the attack vector is network-based; an attacker only needs to transmit the crafted data to the target system. Successful exploitation would provide the attacker with control over the affected user's environment.