The updated vulnerability description indicates a use‑after‑free flaw (CWE‑416) in Microsoft Office that enables an attacker to execute code locally. When a malicious document is opened, the program accesses a memory region that has already been freed, causing memory corruption and allowing the attacker to run arbitrary code with the privileges of the current user.

Affected products include Microsoft 365 Apps for Enterprise, Microsoft Office 2019, Office LTSC 2021, Office LTSC 2024, Office LTSC for Mac 2021, Office LTSC for Mac 2024, and Microsoft Word 2016. Version information is not specified in the advisories, so all currently released versions of these products are considered at risk.

The CVSS score of 8.4 indicates high severity. The EPSS score of < 1% indicates a very low but existing exploitation probability. The vulnerability is not listed in the CISA KEV catalog, suggesting no widely released exploit at this time. Based on the description, the likely attack vector is local, requiring the victim to open a malicious document; however, after exploitation the attacker can run code with the user’s privileges. Immediate patching is advised to mitigate the potential for a severe compromise.