A heap-based buffer overflow exists in Microsoft Office Word that enables an unauthorized attacker to execute arbitrary code on the target system when a specially crafted document is processed. The flaw allows the attacker to run code with the privileges of the user executing Word, potentially allowing full compromise of the host. The weakness falls under CWE-122, indicating unguarded memory usage leading to memory corruption.

The vulnerability affects Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024. No specific patch release versions are listed, so all installations of these products are considered susceptible until the official update is applied.

The CVSS score of 8.8 indicates high severity. The EPSS score is not available, so the likelihood of exploitation cannot be quantified, but the vulnerability can be triggered over a network by an unauthorized attacker. The flaw is not listed in the CISA KEV catalog, suggesting no confirmed exploitation in the wild at the time of this analysis. Attackers would need to deliver a malicious document to a user who opens it in the affected Office product, possibly via email or a network share. If successful, the attacker gains code execution rights on the target system, leading to confidentiality, integrity, and availability compromises.