An untrusted pointer dereference in Microsoft Office enables an unauthorized attacker to execute code locally. The description does not disclose how the flaw is triggered, so it is inferred that opening a malicious Office document could exploit the vulnerability, though this is not explicitly stated. Because local code execution is possible, a compromised user could run arbitrary code with their privileges.

The vulnerability impacts Microsoft Office 2016, Microsoft Office 2019, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. All currently supported releases of these products are affected; no specific version exclusions are documented, so any installed edition remains vulnerable until a security update is applied.

The CVSS score of 7.8 denotes high severity. The EPSS score shows a very low probability of exploitation (< 1 %). The vulnerability is not listed in the CISA KEV catalog, indicating no large‑scale attacks have been observed. The description does not state the exact trigger, so the precise attack vector is not explicitly detailed; it is inferred that the flaw likely requires user interaction with a malicious Office document, triggered, local code execution could allow an attacker to run arbitrary code with the victim’s privileges, potentially leading to full system compromise.