A use‑after‑free flaw in Microsoft Office Word enables an unauthorized attacker to execute arbitrary code. The vulnerability can be triggered by a specially crafted document or payload delivered over a network connection, allowing local code execution that may compromise confidentiality, integrity, and availability of the affected system. It is identified as a CWE‑416 weakness: improper use of memory after it has been freed.

Affected products include Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. No specific patch or version ranges are listed, so all versions of these products are presumed vulnerable until the security update is applied.

The CVSS score of 8.8 classifies this flaw as high severity. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog, which suggests a moderate exploitation probability. The likely attack vector is remote network access, as indicated by the description that the exploit can be delivered over a network. An attacker who successfully exploits this use‑after‑free may gain full control over the victim’s system and potentially spread laterally within a network.