An integer overflow or wraparound occurs in Microsoft Office for Android that allows an attacker who already has authorized local access to elevate their privileges on the device. The flaw involves improper handling of numeric values (CWE-190) and can result in higher privileges, potentially compromising confidentiality, integrity, or availability of data on the device. The issue is limited to local execution; no remote exploitation is described.

Vendors and products affected are Microsoft and Microsoft Office for Android. No specific version identifiers are provided in the CNA data or the description, so the precise affected releases are unknown; all available Office for Android installations may be impacted. The official Microsoft Security Response Center reference lists this vulnerability but does not enumerate affected versions.

The CVSS score of 7.8 categorises the vulnerability as medium‑to‑high severity. The EPSS score of less than 1% indicates a low probability of current exploitation in the wild, and it is not listed in the CISA KEV catalog, suggesting no widespread exploitation. The only attack vector that can trigger the integer overflow is a local, authorised user who can run the Office application. Given these factors, the risk is significant for organisations that allow local use of Office for Android, but the likelihood of exploitation remains low at present.