A heap-based buffer overflow in Microsoft Office Word can be triggered by an attacker who delivers a crafted document over a network, leading to arbitrary code execution on the target system. The flaw enables an unauthorized party to gain execution privileges, compromising the confidentiality, integrity, and availability of the affected system. This represents a high‑severity vulnerability classified by a CVSS score of 8.8.

Microsoft products including Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021 and 2024, and their Mac counterparts for 2021 and 2024 are affected. The vulnerability appears in all listed releases across Windows and macOS platforms.

The high CVSS rating reflects the severity of the remote code execution capability, and the lack of an EPSS score indicates uncertainty about current exploitation prevalence. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation. The attack requires delivery of a malicious document over a network, leveraging the heap overflow to execute code once the document is processed by Word. Inferred attack vectors suggest that attackers could probe the network to send the crafted payload, bypassing local privilege restrictions.