An attacker can trigger a use‑after‑free error in Microsoft Word by opening a specially crafted document. The flaw permits execution of arbitrary code with the privileges of the current user, effectively granting an attacker full control over the affected system. This vulnerability is classified under CWE‑416 and results in a loss of confidentiality, integrity, and availability.

The vulnerability affects Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. No specific sub‑versions are listed, so all releases in these product lines are potentially impacted.

The CVSS score of 7.8 indicates high severity, and while EPSS data is not provided, the lack of KEV listing suggests no known extant exploits yet. However, the flaw can be triggered remotely by delivering a malicious document, commonly via email or shared network locations. Because the attack requires user interaction to open the document, the risk is moderate to high for environments that do not enforce strict attachment filtering. Once triggered, the attacker can inject and run code, leading to complete system compromise.