A type confusion bug in Microsoft Office Word permits an attacker to supply a malicious document that causes the application to access a resource using an incompatible type. This flaw allows the attacker to execute arbitrary code on the victim’s machine with the user’s privileges, potentially leading to full system compromise. The vulnerability is classified as a heap‑based buffer overflow (CWE-122), type confusion (CWE-843), and potential exposure of sensitive information (CWE-908).

The flaw affects Microsoft 365 Apps for Enterprise, Microsoft Office 2019, Office LTSC 2021, Office LTSC 2024, Office LTSC for Mac 2021, Office LTSC for Mac 2024, and Office 2016 Word. All versions of these products are susceptible until addressed by a Microsoft update.

The CVSS score of 8.4 indicates a high severity. Although no EPSS score is published and the issue is not listed in CISA’s KEV catalog, the practical attack scenario—opening a crafted Word file—makes exploitation straightforward for an attacker capable of delivering such a file. Outcomes include local code execution with the rights of the logged‑in user, giving attackers the ability to move laterally, install malware, or exfiltrate data.