Technical impact
A use‑after‑free flaw in Microsoft Office Word allows an attacker to trigger execution of arbitrary code with the privileges of the user who opens a malicious document. The vulnerability causes the software to access freed memory again, enabling the attacker to influence Word’s processing and run code. This can compromise the confidentiality, integrity, and availability of the victim’s data and system. The weakness is classified under CWE‑416.
Affected Systems
Microsoft 365 Apps for Enterprise and Microsoft Office LTSC 2024 are affected. All current releases within these product families are at risk, as no specific sub‑versions are listed. Users of these Office deployments should consider themselves potentially exposed.
Risk and Exploitability
The CVSS base score of 7.8 denotes high severity. EPSS score is not published and the vulnerability is not in the CISA KEV catalog, but the lack of these metrics does not reduce the practical risk. Based on the description, it is inferred that the attacker must supply a specially crafted Word document, which an end‑user opens, making the attack vector likely local or remote via email or file transfer. If exploited, the attacker obtains full control within the user’s session, allowing further lateral movement or persistence.
