A heap‑based buffer overflow in Microsoft Office enables an attacker to execute arbitrary code locally on a victim’s machine when the user opens a specially crafted document. The vulnerability is a classic example of CWE‑122. The exact delivery mechanism is not detailed in the advisory, so it is inferred that the attacker would need to supply malicious input to trigger the overflow, such as via a compromised or malicious Office file presented to the user, for example through email or a file download.

Microsoft 365 Apps for Enterprise, Microsoft Office 2016, Microsoft Office 2019, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024 are all affected. Specific product versions are not listed in the advisory; the recommendation is that all installations of these product lines be considered vulnerable unless otherwise noted by Microsoft.

The flaw scores a CVSS v3.1 of 7.8, indicating high severity when exploit conditions are met. The EPSS score of < 1% suggests that large‑scale public exploitation is unlikely, and it is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker can trigger the overflow by delivering a crafted Office file, for example via email or a compromised website, and that the exploitation requires user interaction to open the file but does not require any additional network access or privileges.