Microsoft Office Word has a heap‑based buffer overflow. Based on the description, it is inferred that an unauthorized attacker can execute arbitrary code by delivering a specially crafted Office document that is opened or processed over a network. The flaw exploits how Word allocates memory for document structures, leading to remote code execution and full compromise of the affected system. The vulnerability is classified as a high‑severity remote code execution issue with a CVSS score of 8.8, categorized under CWE‑122.

The affected products include Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. No specific version ranges or patch levels are listed, so all current instances of these editions may be vulnerable until an official update is applied.

Based on the description, it is inferred that the attacker can trigger the overflow by supplying a specially crafted document to the victim's machine over a network connection. The CVSS score of 8.8 indicates a high risk of impact, and the vulnerability can be triggered remotely via a network connection. Although the EPSS score is less than 1% (approximately 0.00442) and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog, the lack of public exploitation data does not diminish the potential for exploitation. Attackers likely need to deliver the crafted document to the victim’s machine to trigger the overflow and execute code, making the network-based attack the most probable vector.