The vulnerability is a use‑after‑free flaw in Microsoft Office that enables an unauthenticated attacker to execute code locally when a user opens a malicious document. This flaw permits code execution in the user's context. If the user has administrative privileges, the attacker could potentially gain higher-level control. The entry does not provide further technical details beyond that it results in local code execution.

The flaw applies to a wide range of Microsoft Office products, including Microsoft 365 Apps for Enterprise, Office 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, Office 365 for Mac, Office LTSC for Mac 2021, Office LTSC for Mac 2024, and Office for Android. No specific version numbers are listed in the advisory, so all current releases under these families are considered potentially vulnerable.

The CVSS score of 8.4 marks this vulnerability as high severity. The EPSS score of < 1 % indicates that exploitation is considered unlikely but not impossible. Because the vulnerability is not in CISA's KEV catalog and no public exploit is documented, the primary risk factor is the high severity of the flaw. The attack vector is inferred to be local and requires an unauthenticated user to open a malicious Office document. Successful exploitation would give the attacker code execution within the user's session, which could be leveraged for further lateral movement or privilege escalation depending on the target environment.