A heap‑based buffer overflow exists in Microsoft Office products, allowing an unauthorized local attacker to execute arbitrary code. This flaw falls under CWE‑122, and the attacker can gain control of the victim’s process with the privileges of the current user, potentially leading to privilege escalation within the local environment.

The vulnerability affects a wide range of Microsoft Office products, including Microsoft 365 Apps for Enterprise, Office 2016, Office 2019, Office 2021, Office 2024, Office 365 for Mac, Office LTSC 2021, Office LTSC 2024, Office LTSC for Mac 2021, Office LTSC for Mac 2024, as well as SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition.

The CVSS base score of 7.8 indicates a high severity impact; the EPSS score is not available, so the current likelihood of exploitation cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is local—an attacker who obtains or can influence a user on the target machine can exploit the flaw by causing the user to open a specially crafted document or file that triggers the overflow. Once the buffer overflow occurs, the attacker can execute code with the permissions of the logged‑in user.