Untrusted search path flaw in Microsoft Office allows an attacker who can place a malicious executable in a directory that appears before the legitimate Office binaries in the system’s PATH to have that executable run under the context of the Office application. This results in arbitrary code execution locally on the machine, using the privileges of the account that launches the Office program. The description does not claim elevation beyond local privileges or data exfiltration.

Affected Microsoft Office 2016 on both 32‑bit (x86) and 64‑bit (x64) architectures, the Office Deployment Tool, and Microsoft SharePoint Server 2016 Enterprise, SharePoint Server 2019, and SharePoint Server Subscription Edition. All versions that rely on the Office installation directory and system path are susceptible if the affected paths are not secured.

With a CVSS v3.1 score of 7.0 the vulnerability is classified as medium‑to‑high severity. The EPSS score of less than 1 % indicates a very low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is local; an attacker must have write access to a directory that is searched before the Office binaries or be able to manipulate the system path. The limited exploitation requirements reduce overall risk, but the potential for arbitrary code execution makes prompt remediation important.