Untrusted pointer dereference in Microsoft Office allows an attacker who can supply an untrusted file to execute arbitrary code in the context of the logged‑in user. The flaw arises when the application processes data that contains an untrusted pointer, resulting in an undefined pointer dereference. This leads to local code execution that can compromise confidentiality, integrity, and availability by permitting the attacker to read, modify or delete files, install malware, or otherwise take over the affected system. The vulnerability is identified as CWE‑822, a flaw involving pointer dereference of untrusted data.

The vulnerability affects the following Microsoft products: Microsoft 365 Apps for Enterprise; Microsoft Office 2016, 2019, Office LTSC 2021, Office LTSC 2024, Office LTSC for Mac 2021, Office LTSC for Mac 2024; Microsoft SharePoint Enterprise Server 2016; Microsoft SharePoint Server 2016, 2019, and Subscription Edition. The CNA did not publish explicit version ranges, so any instance of the listed products is considered vulnerable unless an update has already been applied.

The CVSS score of 8.4 indicates high severity, while the EPSS score of <1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is inferred to require a local user to open a malicious Office document or to otherwise trigger the erroneous pointer dereference. No network‑based exploitation path is described, so the threat is confined to local users exposed to crafted files.