The vulnerability is a heap-based buffer overflow in Microsoft Office Access. An attacker who can trigger the overflow can execute arbitrary code on a target machine with the privileges of the user running Office. This enables non‑privileged remote code execution, allowing compromise of confidentiality, integrity, and availability of the affected system.

Affected vendors are Microsoft, specifically Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024. No detailed version numbers are available beyond these product lines, but the flaw exists in all supported releases of these families.

The assigned CVSS score is 8.8, indicating high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, via a malicious file or script that is opened or processed by Office Access over a network connection. Given the remote code execution capability and the lack of readily available mitigations, the risk to systems that permit Office Access usage remains significant until a patch or effective workaround is applied.