This vulnerability is a heap-based buffer overflow in Microsoft Office Word that allows an unauthorized attacker to execute code on a target machine. The flaw can be triggered by opening a specially crafted document or payload, resulting in arbitrary code execution with the privileges of the Word process.

The affected products are Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024. The specific version numbers are not listed in the provided data, so the entire reference line of each product should be considered vulnerable until an update is applied.

The CVSS score of 8.8 classifies this as a high severity vulnerability. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector is remote, originating over a network via a malicious office file or payload that an attacker can send to a victim user. Exploitation does not require local privileges beforehand; it relies on the victim opening or otherwise processing the vulnerable file. The impact is arbitrary code execution with the permissions of the user running Word.