The vulnerability is a use‑after‑free in Microsoft Office that allows an authorized local attacker to elevate privileges. An attacker with local access can abuse the flaw to increase their privileges, potentially gaining administrative rights on the affected machine. The issue maps to CWE‑1220, which addresses improper verification of privileges.

Microsoft 365 Apps for Enterprise, Microsoft Office 2019, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024 are affected. The CVE does not list specific version numbers beyond the product families.

The CVSS score of 8.8 indicates a high severity rating. The EPSS score of < 1% suggests a very low probability of exploitation, but the vulnerability is listed as local privilege escalation, implying that the attacker must be physically or remotely logged on with authorized access. Because it is not in the CISA KEV catalog, there is no current evidence of widespread exploitation, yet the importance of patching remains high.