A stack-based buffer overflow in Microsoft Office Word enables an attacker to execute arbitrary code on the victim’s machine, allowing local privilege escalation or execution of malicious payloads. The flaw is a classic buffer overflow in the parsing logic of Word documents, classified as CWE‑121, and can be triggered with a crafted or malicious document accessed by the user. The result is full control over the user session, potentially granting the attacker the same access rights as the logged‑in account.

The vulnerability affects a wide range of Microsoft Office products across Windows and macOS, including Microsoft 365 Apps for Enterprise, Office 2019, Office 2021, Office 2024, Office LTSC 2021 and 2024, Office 365 for Mac, Office LTSC for Mac 2021 and 2024, and Word 2016. All listed versions are impacted; the CVE entry does not specify a version range, so users should treat all current releases as potentially vulnerable until a patch is applied.

The CVSS score of 7.8 indicates a high severity, while the EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The flaw is local and depends on the user opening a malicious Word document; therefore, the attack vector is likely an infected file or file delivered via email. Although no public exploits are reported, the nature of the stack overflow and the widespread use of these Office products raise the potential for exploitation once a document is opened.