The vulnerability is a heap-based buffer overflow in Microsoft Office Access that allows an unauthorized attacker to execute arbitrary code over a network. This flaw can lead to remote code execution, compromising confidentiality, integrity, and availability of the affected system. The weakness is identified as CWE-122, a classic memory corruption issue that enables code execution when untrusted data is processed.

The issue affects Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024. These products are part of the Microsoft Office suite used in many enterprise environments. The affected versions are those in the long‑term servicing channel for 2021 and 2024, as well as the 365 enterprise editions.

The CVSS score is 8.8 indicating high severity. EPSS is not available, so the current exploitation probability is unknown, but the flaw permits remote code execution over the network, making it potentially exploitable by attackers with network access. The vulnerability is not yet listed in CISA KEV. Attackers would likely need to deliver malicious content via Office Access files or network interaction with the vulnerable component. It is inferred that the attack vector is network-based because the description mentions execution over a network. The lack of a KEV listing suggests no widespread exploitation known as of now, but the high CVSS and network reach warrant immediate attention.