An integer overflow or wraparound bug in Microsoft Office components allows an unauthorized attacker to cause locally privileged code execution. The flaw occurs when processing crafted input, leading to a corruption of program state that can be exploited to run arbitrary code with the credentials of the user who opens the damaged Office file or macro. This gives the attacker the ability to compromise the system, install malware, or elevate privileges on the infected machine.

Microsoft Office products including Microsoft 365 Apps for Enterprise, Office 2016, Office 2019, Office 365 for Mac, Office LTSC 2021, Office LTSC 2024, Office LTSC for Mac 2021 and Office LTSC for Mac 2024 are affected across Windows and macOS platforms. No specific affected version information is provided.

The CVSS score of 7.8 indicates a high severity of the vulnerability with a significant impact on confidentiality, integrity, and availability. Because the EPSS score is < 1%, the exploitation probability is very low, yet the lack of a KEV listing and the nature of the flaw suggest that it has not yet been widely exploited in the wild, though it remains a serious risk. The likely attack vector is a local user opening a malicious Office document, typically delivered via email or a shared network location, which would trigger the overflow and enable code execution.