The vulnerability involves a heap‑based buffer overflow in Microsoft Office Visio that permits an attacker to execute arbitrary code remotely. This overflow is classified as CWE‑122 and additionally involves a signed/unsigned mismatch (CWE‑193). Successful exploitation can lead to complete compromise of the affected system, allowing an attacker to run code with the privileges of the Office application.

The flaw applies to Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024, encompassing the Office suite’s long‑term servicing channel releases.

The CVSS score of 8.8 denotes high severity. The EPSS score of less than 1% indicates current exploitation probability is low, and the vulnerability is not listed in the CISA KEV catalog, meaning no publicly confirmed exploits are recorded. The vulnerability allows code execution over a network, implying an attacker must deliver a malicious Visio file from a remote source to trigger the overflow. Given the high severity and lack of public exploits, organizations should prioritize remediation.