The vulnerability is a use‑after‑free flaw in Microsoft Office’s Click‑To‑Run deployment that allows an authorized local user to gain higher privileges on the affected machine. Because the flaw involves memory corruption, a successful exploitation could bypass the user’s original access level, compromising confidentiality, integrity, or availability of the system. The weakness is identified as CWE‑416.

Affected products include Microsoft 365 Apps for Enterprise, Microsoft Office 2019, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024. The CVE description does not specify sub‑versions, so any installation of these products is potentially vulnerable.

The CVSS score of 7.8 indicates a high severity. EPSS is not available, so the current exploitation probability is unknown, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be local, requiring an authorized user to have access to the machine. If the flaw is exploited, the attacker can elevate privileges locally, potentially allowing lateral movement in the environment or full control over the affected system.