An attacker who can trigger a type confusion condition in Microsoft Office products can cause the application to treat data of one type as another. This flaw permits the execution of arbitrary code locally on the target machine. The failure arises because the software fails to validate that a resource is of the expected type before accessing it.

Affected products include Microsoft 365 Apps for Enterprise, Microsoft Office 2019, Office 2021, Office 2024, Microsoft Office 365 for Mac, Office LTSC 2021 and LTSC 2024, Office LTSC for Mac 2021 and LTSC for Mac 2024, Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019, SharePoint Server Subscription Edition, and Microsoft Word 2016. No specific version ranges are listed in the CNA data, so all current releases of these products are potentially vulnerable until a patch is applied.

The vulnerability receives a CVSS score of 8.4, indicating high severity. No EPSS score is available, so the exploitation probability cannot be quantified at this time. The flaw is not listed in the CISA KEV catalog. Because the attack requires the ability to supply data that is interpreted as an incompatible type, the attack vector is likely a crafted document opened within the affected Office application. Multiple product lines are affected, increasing the potential impact across enterprise environments.