An untrusted pointer dereference in Microsoft Office Word enables an attacker with local access to execute arbitrary code. Once exploited, the attacker can run code with the privileges of the user, potentially compromising the confidentiality, integrity, and availability of the affected system. The weakness is classified as CWE-822, a type of memory corruption that can lead to code execution.

Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021, Office LTSC 2024, Office LTSC for Mac 2021, and Office LTSC for Mac 2024. All versions of these products that contain the vulnerable Word component are impacted. Specific patch versions are not listed in the data, so any current installation is potentially vulnerable.

The CVSS score of 8.4 reflects a high severity vulnerability. No EPSS score or KEV listing is available, indicating that public exploitation evidence may be limited at this time. The attack likely requires local access to trigger the pointer dereference, meaning it is a local code execution risk rather than a remotely exploitable RCE. The exploit path involves corrupting memory through untrusted input processed by Word, which can then lead to arbitrary code execution.