A use‑after‑free flaw in Microsoft Office components allows an unauthorized local attacker to run arbitrary code with the privileges of the user who opens a crafted Office document. The vulnerability originates from improper memory handling (CWE‑416), which can overwrite pointers or control data and redirect execution to attacker‑supplied code.

Microsoft 365 Apps for Enterprise, Microsoft Office 2016, Microsoft Office 2019, Office LTSC 2021, and Office LTSC 2024 are affected. No specific version range is provided, so all releases of these products remain vulnerable until a patch is applied.

The CVSS score of 7.8 indicates moderate‑to‑high severity, but the EPSS score of less than 1% shows a low probability of public exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local: an attacker must persuade a user to open a malicious Office document or otherwise supply crafted content that triggers the reuse error. Once the flaw is leveraged, arbitrary code runs with the user’s credentials. The absence of publicly available proof‑of‑concept suggests exploitation may remain limited to skilled adversaries.