A heap-based buffer overflow (CWE‑122) is present in Microsoft Office products, allowing an unauthorized attacker to execute code locally on the affected system. The CVE description states that the overflow can be triggered by an attacker, giving them the same privileges as the user and enabling execution of arbitrary code on the host.

The vulnerability affects Microsoft 365 Apps for Enterprise, Microsoft Office 2016, Microsoft Office 2019, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and Microsoft Office for Android. No specific patch levels are listed, so any installation of these products that has not yet received the latest update may be vulnerable.

The CVSS base score of 8.4 indicates severe potential impact. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, suggesting that widespread exploitation has not yet been observed. Based on the nature of heap overflows in Office applications, the likely attack vector is the opening or processing of a specially crafted Office document or file; this inference is made because the description indicates code execution through a heap overflow during document handling, but the exact trigger is not explicitly provided.