The vulnerability is a heap‑based buffer overflow in Microsoft Office OneNote that can be triggered by an attacker without authentication. When exploited, the attacker can gain code execution on the target system, potentially compromising data integrity and confidentiality. This weakness is classified as CWE‑122. The reported CVSS score of 8.8 indicates a high severity level for remote code execution.

The flaw affects Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. These are identified by the respective Microsoft Office product names and are used on macOS platforms. No specific sub‑versions are listed beyond the product families.

The vulnerability can be triggered over the network by an unauthorized attacker. No EPSS score is available, so the likelihood of exploitation cannot be quantified from the data provided. Because the issue is not currently listed in the CISA KEV catalog, it may not yet be known as an actively exploited vulnerability. Nonetheless, the CVSS metric indicates that if an exploit is available, it could result in remote code execution on the affected macOS machines.