A heap-based buffer overflow exists in the Access component of Microsoft Office. When an unauthenticated attacker crafts a specially designed input over a network, the overflow can be triggered, allowing the attacker to execute arbitrary code on the host. The flaw stems from improper bounds checking in memory allocation, a classic source of loss of control of program flow.

The vulnerability affects Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024. Users running any of these editions are potentially exposed if the vulnerable code paths are exercised.

The CVSS score of 7.5 indicates a high severity. The EPSS score is <1%, indicating a very low but non-zero probability of exploitation. The flaw is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation yet. Based on the description, the likely attack vector involves an unauthorized network attacker sending crafted data to an Office application running on the target. If exploited, full OS compromise may be achievable, depending on privilege levels.