The vulnerability arises from a stack-based buffer overflow in Microsoft Office Word. An attacker who successfully exploits the flaw can execute arbitrary code on the victim’s computer, giving them the same privileges as the user. This is a classic stack overrun (CWE-121) that can be triggered by processing a specially crafted document. The impact includes potential compromise of confidentiality, integrity, and availability on the target system.

Affected systems include Microsoft 365 Apps for Enterprise, Microsoft Office 2019, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021 and 2024, Microsoft Office LTSC for Mac 2021 and 2024, and Microsoft Word 2016. The CVE covers all active releases of these products; no specific patch versions are listed in the data.

The CVSS base score of 7.8 indicates high severity, yet there is no EPSS score available to gauge current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Likely exploitation would involve an attacker delivering a malicious Office document to a user, who would need to open the file, which would trigger the buffer overflow and allow local code execution.