The vulnerability is caused by an integer overflow or wraparound in Microsoft Office that allows an unauthorized attacker to run arbitrary code locally. When Office processes a malformed file, the integer overflow can be exploited to execute code with the privileges of the user who opens the file, potentially leading to full system compromise if the user has administrative rights.

It strikes several Microsoft Office products: Microsoft 365 Apps for Enterprise, Office 2016, Office 2019, Office 365 for Mac, Office LTSC 2021, Office LTSC 2024, Office LTSC for Mac 2021, and Office LTSC for Mac 2024. No specific version ranges are provided in the current data, so any installation of these products is potentially vulnerable until Microsoft releases a fix.

The CVSS score of 7.8 marks the issue as high severity, and it is not listed in the CISA KEV catalog. No EPSS data is available. The likely attack vector is the delivery of a crafted Office document or file that triggers the integer overflow when opened by a user, as inferred from the description. The impact is significant, affecting confidentiality, integrity, and availability through local code execution.