A flaw in Microsoft Word's handling of untrusted input allows an attacker who can supply local data to bypass a security restriction. The weakness stems from insufficient validation of data used in a security decision, classified as CWE‑807. When exploited, the attacker can gain access to functionality normally protected, potentially exposing sensitive documents or enabling further malicious actions within the Office environment.

Microsoft Office 365 for Mac, Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024 are affected. The vulnerability applies to the Office builds listed in the CNA affected-products list, covering both Windows and macOS deployments of the listed editions.

The CVSS score of 7.8 indicates a high severity vulnerability. EPSS data is not available, so the exact likelihood of exploitation cannot be quantified from the public metrics. The vulnerability is classified as Local, meaning the attacker must already have access to the affected machine’s user session to supply the untrusted input. It is not listed in the CISA KEV catalog, and no exploit code is publicly documented at the time of this analysis. Inferred from the description, an attacker could craft a malicious document or exploit a local input path to trigger the bypass. The lack of remote access requirement limits the threat to environments where local users or malware running locally exist.