An integer overflow or wraparound flaw in Microsoft Office Word permits an unauthorized attacker to run arbitrary code. The vulnerability arises when the application processes specific data, potentially leading to uncontrolled memory access. An attacker could exploit this flaw from the network, achieving remote code execution and compromising confidentiality, integrity, and availability of the affected system.

Affected versions include Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. The issue spans both Windows and macOS installations of Office under the listed editions.

The CVSS score of 7.5 indicates a high severity. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog. However, the attack vector is network‑based and does not require prior credential or local compromise, making the exploitation path straightforward for an attacker with remote access. Given the ability to execute code without user interaction, the risk to affected deployments remains significant until the update is applied.