Untrusted pointer dereference in Microsoft Word enables an attacker to execute code on the system without proper authorization. The vulnerability stems from a classic use‑after‑free flaw (CWE‑416), providing unauthorized code‑execution capabilities when a malicious document is processed by the application.

The flaw affects Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. Specific version details are not disclosed in the available CNA data.

With a CVSS score of 7.8 the flaw is considered high severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is the opening of a malicious document or macro‑enabled file that triggers the unsafe pointer dereference, allowing local code execution. Mitigation depends on timely application of the vendor’s fix.