The vulnerability is a use‑after‑free condition in Microsoft Office that allows an attacker to execute arbitrary code when a malicious Office document is opened. The flaw falls under CWE‑416 and grants the attacker local code execution privileges, potentially compromising the integrity of the affected system.

Affected vendors include Microsoft with products such as Microsoft 365 Apps for Enterprise and Microsoft Office releases 2016, 2019, LTSC 2021, LTSC 2024, LTSC for Mac 2021, and LTSC for Mac 2024. All listed versions of these products are impacted; specific version patches are not delineated in the available data.

The CVSS score of 8.4 indicates a high severity vulnerability, yet the EPSS score is reported as less than 1%, implying a low current exploitation probability. The flaw is not referenced in the CISA Known Exploited Vulnerabilities catalog. Likely exploitation requires a local attacker delivering a crafted Office file, often via email or web download, to trick a user into opening the document. Successful exploitation would enable arbitrary code execution on the victim’s machine.