The vulnerability is a use‑after‑free flaw in Microsoft Office that permits an attacker to execute arbitrary code locally. This can lead to compromise of confidentiality, integrity, and availability on the affected system. The weakness is identified as CWE‑416.

Affected products are Microsoft 365 Apps for Enterprise, Microsoft Office 2016, Microsoft Office 2019, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. Version information is not specified, so all released versions of these products may be vulnerable.

The CVSS score of 8.4 indicates high severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local, and the attacker would need to deliver a malicious Office document or otherwise trigger the use‑after‑free condition while the application is running.