This vulnerability is a heap-based buffer overflow (CWE‑122) in Microsoft Office Access that enables an attacker to execute arbitrary code when a specially crafted document is processed. The flaw permits unauthorized code execution, potentially compromising confidentiality, integrity, and availability of the affected system.

Affected products are Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024. Exact sub‑version details are not provided, so all current builds of these products are considered vulnerable until a specific fix is released.

The CVSS score of 8.8 indicates a high severity risk. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, but the nature of the flaw allows a network‑based attacker to trigger it remotely. The likely attack vector is over a network communication channel that delivers malicious content to the vulnerable Office application. If exploited, an attacker could gain code execution privileges on the target machine.