The flaw is a heap‑based buffer overflow in Microsoft Office Word that can be triggered by an attacker who successfully delivers a malicious Word document over the network. This overflow, arising from insufficient input validation, allows the adversary to execute arbitrary code with the privileges of the user running Word. The affected weakness is catalogued as CWE‑122 and CWE‑20. If exploited, an attacker could gain full control of the affected system, compromising confidentiality, integrity, and availability.

Microsoft has identified the affected products as Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024. Specific patched or unpatched version ranges are not provided; administrators should verify the current installation version of each edition and ensure it is up to date.

The CVSS score of 8.8 indicates a high severity risk. The EPSS score of 0.00463 (0.463%) suggests a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is the delivery of a crafted Word document over a network share or via network‑based media; the exploit would require that the document be opened or processed by the victim’s Office installation.