The heap-based buffer overflow in Microsoft Word allows an attacker to place malformed content into a document and execute arbitrary code on the target system when the document is opened. This flaw permits remote code execution, giving the attacker control over the affected machine. The weakness is a classic memory corruption flaw represented by CWE-122.

Affected vendors include Microsoft; the products impacted are Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024. Specific version numbers are not listed in the advisory, so all current builds of these products are potentially vulnerable until a patch is applied.

The CVSS score of 8.8 indicates a high severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting a moderate exploitation likelihood. The attack vector is inferred to be network-based, as the document can be transmitted over a network to trigger the overflow when opened by an unsuspecting user.