Heap-based buffer overflow in Microsoft Office Access enables an unauthorized attacker to execute arbitrary code when the affected application processes specially crafted data over a network connection. The vulnerability is exploitable remotely and can lead to full compromise of the host, granting the attacker control and access to confidential data.

Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024 are impacted. No specific version exclusions are listed, so all deployments of these products are considered vulnerable until a patch is applied.

The CVSS score of 7.5 indicates a high severity, but the EPSS score is unavailable, so the current likelihood of exploitation is unknown. The vulnerability is not listed in CISA's KEV catalog, suggesting no confirmed widespread exploitation yet. The described network-based RCE means that an attacker can target the application from an external host without requiring local privileges.