A heap-based buffer overflow in Microsoft Office Word allows an attacker to execute code remotely. The flaw is caused by improper handling of heap allocation, leading to memory corruption that can be exploited to run arbitrary code. This results in full control over the affected system, compromising confidentiality, integrity, and availability. The weakness is identified as CWE-122 and also involves numeric truncation errors (CWE-197).

The vulnerability affects Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024. All current releases of these products are impacted as described by the Microsoft security advisory.

With a CVSS score of 8.8, the vulnerability carries a high severity rating. The EPSS score is not available, and it is not listed in the CISA KEV catalog, indicating no known public exploits yet. The likely attack vector is over a network; an unauthorized attacker could deliver a malicious document or attachment to a user running Office Word, triggering the heap overflow and achieving remote code execution. Successful exploitation would provide adversaries with full local privileges on the victim machine.