This vulnerability is a classic use‑after‑free flaw found in several Microsoft Office products. An attacker who can supply a specially crafted Office document can cause the application to free an object and later use the same memory location, allowing the attacker to execute arbitrary code on the target computer. The primary impact is the ability to take over the victim’s system, violating confidentiality, integrity, and availability.

Affected Microsoft Office products include Microsoft 365 Apps for Enterprise, Office 2019, Office 365 for Mac, Office LTSC 2021, Office LTSC 2024, Office LTSC for Mac 2021, and Office LTSC for Mac 2024. The vulnerability applies to all current builds of these releases as listed in the product catalog.

The CVSS score of 8.8 marks this as a high‑severity flaw. The EPSS value is not available, indicating no published data on exploitation frequency; however, the lack of a KEV listing does not diminish the need for prompt action. Based on the description, it is inferred that the attack vector requires network or local access to open a malicious Office file. Once executed, the attacker can run code with the privileges of the logged‑in user, potentially gaining full control of the affected system.