Untrusted pointer dereference in Microsoft Office allows an unauthorized attacker to execute code locally. The flaw is classified as CWE-822, untrusted pointer dereference. Trigger details are not specified, so it is inferred that interacting with a malicious Office file could activate the vulnerability. Successful exploitation leads to local code execution, allowing the attacker to run arbitrary code with the privileges of the user who opens the file.

The vulnerability affects Microsoft 365 Apps for Enterprise, Microsoft Office 2016, Microsoft Office 2019, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. All currently supported releases remain vulnerable until a security update is applied; no version exclusions are specified.

The CVSS score of 7.8 indicates high severity. The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, meaning no large‑scale attacks have been reported. The lack of explicit trigger details means the attack vector is not explicitly defined in the description, but it is inferred that the flaw likely requires user interaction with a malicious Office document. Local code execution grants the attacker arbitrary code execution with the victim’s user privileges, potentially leading to full system compromise if the user has administrative rights.