An incompatible type access occurs when a Microsoft Office object is used with an unexpected type, a flaw referred to as type confusion. This flaw permits an attacker to run arbitrary code on the affected system with the privileges of the user who launches the compromised document. The Microsoft Office note identifies the vulnerability as leading to local code execution, thereby compromising confidentiality, integrity, and availability of the host machine.

The flaw affects Microsoft Office LTSC 2024, specifically impacting the Outlook and Word applications. Any user consuming a malicious Office document created for this version is at risk.

The CVSS score of 8.4 classifies this as a high‑severity vulnerability. EPSS is not available, so the quantitative likelihood of exploitation cannot be determined, but the fact that the flaw causes local execution suggests a local user or attacker who can deliver a malicious document may succeed. The vulnerability is not listed in the CISA KEV catalog, implying no confirmed widespread exploitation yet. Given the lack of an explicit remote attack vector in the description, it is reasonable to infer that the primary exploitation path involves a user opening a crafted Office file, possibly via email or file share. If the vulnerability were to be exposed in a remote context, the risk would increase markedly.