The vulnerability is a heap-based buffer overflow in Microsoft Office that allows an unauthorized attacker to execute code over a network. The overflow occurs during memory handling in Office's internals, corrupting data structures to enable arbitrary code execution with the privileges of the user. This satisfies the criteria for remote code execution identified by CWE‑122.

The vulnerability affects Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. All supported releases of these products are listed as impacted, with no specific patch version noted in the advisory.

With a CVSS score of 8.8 the vulnerability is considered high severity. The EPSS score is not available, but the lack of exploitation data does not reduce the potential impact. The vulnerability is not currently listed in CISA’s KEV, indicating no confirmed widespread exploitation yet. Based on the description, it is inferred that the attacker must be able to send malicious data over the network to the target Office application or deliver a malicious document. The use of a heap overflow enables arbitrary code execution, potentially allowing privilege escalation or remote code execution on the host machine.