The vulnerability is a heap-based buffer overflow (CWE-122) in Microsoft Office Outlook. An attacker who can send malicious content over a network can trigger the overflow, which allows them to execute arbitrary code with the privileges of the user who opens the data. If exploited, the attacker could gain full control of the affected system, read or modify sensitive information, or install additional malware.

Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024 are all affected. The issue exists in the Outlook component included in these Office suites; specific patch version details can be obtained from the Microsoft security advisory.

The CVSS score is 7.5, indicating High severity, and no EPSS data is available, which suggests the exploitation probability is not currently quantified. The vulnerability is not listed in the CISA KEV catalog, implying no known widely deployed exploit exploits. The attack vector is likely remote over the network, as the overflow can be triggered by malicious content delivered via email attachments or web forms. The risk is considerable because exploitation grants code execution on the affected machine, potentially enabling broader attacks within the network.