A stack‑based buffer overflow flaw exists in Microsoft Office Word that permits an unauthorized attacker to execute code over a network. The vulnerability arises when Word processes insecure input, leading to uncontrolled memory writes. This allows the attacker to run arbitrary code with the privileges of the user whose Word instance is handling the malicious content. The weakness corresponds to CWE‑121.

Affected are selected Microsoft 365 and Office products, including Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021 and 2024, as well as the Mac versions of the LTSC releases for 2021 and 2024. No specific patch or version numbers are listed beyond the product families.

The CVSS score of 8.8 indicates high severity; the EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog. The flaw can be exploited remotely over a network by delivering a crafted document or embedded content, which is inferred from the description that the attack can be performed over a network. Attackers would need network access to a vulnerable Word installation to trigger the overflow and execute code.