A use‑after‑free flaw in Microsoft Word allows an attacker to execute arbitrary code on the local machine when a specially crafted document is processed. The flaw falls under CWE‑416 and can be triggered without external network connections, meaning the compromise is local but can provide the attacker with the privileges of the user who opens the file.

The vulnerability affects multiple Microsoft Office product families, including Microsoft 365 Apps for Enterprise; Microsoft Office 2019; the long‑term servicing channel releases 2021, 2024, and their Macintosh editions; as well as Microsoft Word 2016. No specific version ranges are listed, so all builds of these applications that have not received the patch are potentially vulnerable.

With a CVSS score of 8.4 the flaw is considered high severity; the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploit samples yet. An attacker would need to deliver a malicious Word file to a target user, for example via phishing or other delivery channel. Opening the file can trigger the use‑after‑free bug, leading to arbitrary code execution on that system, which poses a significant risk for any workstation running the affected Office applications.