A type confusion bug in Microsoft Office Word permits an attacker to supply a malicious document that causes the application to access a resource using an incompatible type. This flaw allows the attacker to execute arbitrary code on the victim’s machine with the user’s privileges, potentially leading to full system compromise. The vulnerability is classified as a heap‑based buffer overflow (CWE-122), type confusion (CWE-843), and potential exposure of sensitive information (CWE-908).

The flaw affects Microsoft 365 Apps for Enterprise, Microsoft Office 2019, Office LTSC 2021, Office LTSC 2024, Office LTSC for Mac 2021, Office LTSC for Mac 2024, and Office 2016 Word. The specific versions susceptible are not enumerated in the CVE data, but all publicly supported versions are likely impacted until a Microsoft update is applied.

The CVSS score of 8.4 indicates a high severity. The EPSS score of 4% indicates a relatively low but non‑zero probability of exploitation, and the issue is not listed in CISA’s KEV catalog, but the practical attack scenario—opening a crafted Word file—makes exploitation straightforward for an attacker capable of delivering such a file. Outcomes include local code execution with the rights of the logged‑in user, giving attackers the ability to move laterally, install malware, or exfiltrate data. Based on the description, the likely attack vector is inferred to be a user opening a crafted Word document, a scenario that does not require elevated privileges or network access beyond the attacker’s ability to deliver the file.