The vulnerability is a heap-based buffer overflow that can be triggered when Office Access processes a malicious object. An attacker with network access can cause the vulnerable code to execute arbitrary instructions, potentially taking control of the compromised system. The weakness originates from inadequate bounds checking during data handling, leading to a typical memory corruption scenario.

Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021 and LTSC 2024 are affected. These editions are commonly deployed in corporate environments where daily operational documents are edited over a network.

The CVSS score of 8.8 classifies the issue as high severity. No EPSS data is available, and the vulnerability is not listed in CISA's KEV catalog. The (inferred) attack vector is over the network, requiring an attacker to supply a crafted Office Access file to a user’s machine. The exploit would grant code execution without user interaction beyond opening or processing the file.