Microsoft Office is vulnerable to type‑confusion because a resource is accessed using an incompatible type. The flaw enables an attacker to trigger execution of arbitrary code on the local machine. The impact is local code execution as confirmed by the vendor description, and the weakness is classified as CWE‑843, Type Confusion.

The vulnerability affects Microsoft 365 Apps for Enterprise, Microsoft Office 2016, 2019, LTSC 2021, LTSC 2024, LTSC for Mac 2021, LTSC for Mac 2024, and Office for Android. No specific affected patch or version numbers are supplied in this record, so the full set of releases listed in the vendor data is considered potentially vulnerable.

The CVSS score of 8.4 indicates a high severity while the EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not currently listed in the CISA KEV catalog. The attack vector is likely local; an attacker would need to supply or supply a malicious document or other payload that triggers the type‑confusion. The description does not explicitly state the method of delivery, so this assessment is inferred from the nature of the flaw and typical Office exploitation mechanisms.