Microsoft Word allows an attacker to supply an externally controlled file name or path that is then used by the application during processing. By crafting a malicious document that references a controlled path, an attacker can cause the application to execute arbitrary code with the privileges of the current user, potentially compromising confidentiality, integrity, and availability of the affected system.

The vulnerability affects several Microsoft 365 and Office products, including Microsoft 365 Apps for Enterprise, Office 2016, Office 2019, Office 365 for Mac, Office LTSC 2021, Office LTSC 2024, and Office LTSC for Mac 2021. The affected versions are those current at the time of the advisory, encompassing both Windows and macOS platforms for the listed product families.

With a CVSS score of 7.8, this flaw presents a high severity risk. No EPSS score is available, but the exploitability claim is that local code execution can be triggered simply by opening a crafted document, indicating that exploitation is straightforward once the document is delivered. The vulnerability is not listed in the CISA KEV catalog, suggesting that a widely available exploit has not yet been observed in the wild. The most likely attack vector is a social‑engineering attack where the victim is coaxed into opening a malicious Word document. In the absence of a known public exploit, the threat remains primarily as a high risk for organizations that enable Office document opening from untrusted sources.