The vulnerability is a heap-based buffer overflow in Microsoft Office Word that can allow an attacker to execute arbitrary code on a target system. The primary consequence is remote code execution, potentially compromising confidentiality, integrity, and availability of the affected machines.

Microsoft Office Word is affected in Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024. No specific patch-version information is provided, so all current releases of these products are considered vulnerable until a fix is applied.

The CVSS score of 8.8 indicates a high severity. EPSS data is not available, and the vulnerability is not listed in CISA's KEV catalog, so the exact exploitation likelihood is unknown. Based on the description, the likely attack vector is over a network, where an unauthenticated attacker can deliver a malicious Office document to the target device. The vulnerability remains exploitable until a vendor patch is deployed.