The vulnerability is a heap-based buffer overflow in Microsoft Office that permits an attacker to execute arbitrary code locally on the victim’s system, potentially compromising confidentiality, integrity, and availability. This flaw correlates with CWE-416,"Use After Free", indicating that improper memory management can lead to code execution. Abuse of the overflow could allow full system compromise in the hands of a skilled attacker.

Microsoft 365 Apps for Enterprise, Microsoft Office 2016, Microsoft Office 2019, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and Microsoft Office for Android.

The CVSS score of 8.4 indicates a high severity. EPSS is not available, but the absence of a KEV listing does not reduce the risk; the vulnerability remains exploitably far from common public exposure. Attackers are likely to use a malicious document or file that the user opens or that is processed automatically by Office; a local, authenticated user can trigger the overflow and run code with the Office process’s privileges. No active exploit has been publicly reported, but the high severity warrants immediate attention.