The vulnerability is a heap-based buffer overflow in Microsoft Office Word, classified as CWE-122, that enables an unauthorized attacker to trigger arbitrary code execution over a network. When a vulnerable Word instance processes a specially crafted document or payload, the overflow can be triggered, which may allow the attacker to gain the privileges of the user and compromise confidentiality, integrity, and availability of the affected system. The flaw is remotely exploitable, with code execution possible without authentication once the target receives the malicious object.

The affected products include Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. No specific version numbers are supplied in the CNA data, so all currently deployed versions of these Office Word editions should be treated as vulnerable until a remedial update is applied.

The CVSS score of 8.8 indicates a high severity vulnerability. The EPSS score is not available, but the remote nature of the vulnerability suggests that an attacker could exploit it from outside the host, making the attack surface non-trivial. The flaw is not listed in the CISA KEV catalog, yet the high impact warrants immediate remediation. The likely attack vector is an unauthenticated network-based attack that sends the malicious payload, such as a crafted document, to a target running a vulnerable Office installation.