A heap‑based buffer overflow in Microsoft Office permits an attacker to execute arbitrary code when the application loads a malicious file. The flaw can lead to full compromise of the user’s machine, allowing the attacker to run payloads, compromise data, or pivot to other systems. The weakness is identified as CWE‑122, which indicates that memory corruption can be leveraged without privileged input sanitization.

The affected products are Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and Microsoft Office for Android. Users running any of these versions should verify that they are on the lowest version number indicated in the list and seek an update.

With a CVSS score of 7.8 this vulnerability falls into the high‑severity range. No EPSS score is published, and the vulnerability is not yet in CISA’s KEV catalog, suggesting that exploitation is possible but not yet observed in the wild. The likely attack vector is via a user opening a specially crafted document or file that exploits the heap overflow. Successful exploitation requires local execution of the Office application and therefore typically depends on user interaction. The overall risk is high for systems that permit users to open untrusted Office files.