The vulnerability is a type‑confusion flaw in Microsoft Office Word. An attacker can cause the application to access a resource using an incompatible type, enabling the execution of arbitrary code on the local machine. This flaw, classified as CWE‑416, is triggered by opening a specially crafted document and gives the attacker the privileges of the user who opens it.

The vulnerability affects multiple Microsoft Office product families, including Microsoft 365 Apps for Enterprise; Microsoft Office 2019; the long‑term servicing channel releases 2021, 2024, and their Macintosh editions; as well as Microsoft Word 2016. No specific version ranges are listed, so all builds of these applications that have not received the patch are potentially vulnerable.

With a CVSS score of 8.4 the flaw is considered high severity; the EPSS score is < 1 % and the vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploit samples yet. An attacker would need to deliver a malicious Word file to a target user, for example via phishing or other delivery channel. Opening the file can trigger the type‑confusion bug, leading to arbitrary code execution on that system, which poses a significant risk for any workstation running the affected Office applications.