The vulnerability is a stack-based buffer overflow in Microsoft Office Word that permits an unauthorized attacker to execute arbitrary code. The flaw can compromise confidentiality, integrity, and availability by allowing malicious code to run with the privileges of the affected user. The weakness is identified as CWE‑121 and could enable attackers to gain full system control if exploited.

Microsoft 365 Apps for Enterprise; Microsoft Office 365 for Mac; Microsoft Office LTSC 2021; Microsoft Office LTSC 2024; Microsoft Office LTSC for Mac 2021; Microsoft Office LTSC for Mac 2024

The CVSS score of 8.8 indicates a high severity RCE risk. EPSS data is not available, but the vulnerability is reported to be exploitable over a network, suggesting that a malicious document sent via email or accessed through a shared drive could trigger the overflow. Although the vulnerability is not listed in CISA’s KEV catalog, the lack of a mitigation from Microsoft currently means the risk remains significant if software is not updated.