This vulnerability is a heap‑based buffer overflow in Microsoft Office Visio that can allow an attacker to execute arbitrary code on a system. The flaw arises from improper handling of user‑supplied input, and the CVE description highlights an unauthorized attacker’s ability to trigger the overflow over a network. The vulnerability is classified under CWE‑122 (Heap Buffer Overflow) and CWE‑190 (Integer Overflow). The potential impact of exploitation includes compromise of confidentiality, integrity, and availability, with the attacker gaining execution privileges on the affected machine. The input does not explicitly state whether authentication is required, so the exact requirements for exploitation cannot be guaranteed from the data provided.

Affected systems include Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024. No version granularity is supplied, so all installations of Visio within these editions are considered vulnerable until a patch is applied.

The CVSS score of 8.8 signals high severity, and the EPSS score of less than 1% indicates low publicly observed exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the overflow can be triggered remotely, though the necessary authentication state is not defined in the data. Therefore, the risk remains high, and administrators should assume that the flaw could lead to remote code execution if an attacker can supply the malicious input.