The CVE entry describes a flaw in Microsoft Word that arises when the application processes untrusted input in a security decision. The vulnerability allows an attacker with local access to bypass a built‑in security feature, potentially enabling the execution of code or content that would normally be blocked. This corresponds to a broken access control weakness identified as CWE-807.

Affected releases include Microsoft 365 Apps for Enterprise, Office LTSC 2021, Office LTSC 2024, and the macOS versions of Office LTSC 2021 and 2024. The vendor information does not list explicit version ranges, so any installation of these suites is considered vulnerable until a fix is applied.

The impact carries a CVSS score of 7.8, which indicates high severity. The EPSS score of 4 % suggests that exploitation is occurring at a low but non‑negligible rate. The vulnerability is present in CISA's Known Exploited Vulnerabilities catalog, confirming that attackers have leveraged it. Because the flaw is local, an attacker must already have some degree of local access; no remote exploitation path is disclosed. The likely attack vector is a classic local bypass scenario where the attacker can exploit the vulnerability from within the system.