A stack‑based buffer overflow exists in Microsoft Office Word that permits remote code execution when an attacker with network access sends a crafted Word document to a victim. This vulnerability is a classic stack overflow (CWE‑121) and could allow an unauthenticated attacker to run arbitrary code on the target machine, potentially compromising confidentiality, integrity, and availability. The flaw lies in Word’s handling of buffer boundaries, enabling the attacker to overwrite control data and hijack execution flow.

The flaw affects Microsoft Office components across multiple product families. It is present in Microsoft 365 Apps for Enterprise, Microsoft Office 2019, the various long‑term servicing channel releases (LTSC) of Office 2021 and 2024, Office 365 for Mac, Office LTSC for Mac 2021 and 2024, and Office 2016 Word. No specific version numbers are provided, so all listed editions are considered vulnerable.

The CVSS score of 8.8 indicates high severity, and the absence of an EPSS score suggests insufficient data on exploitation probability, though the lack of KEV listing means no publicly known exploitable code yet. Attackers would need network reach to the target machine, typically by sending a malicious Word document via email or shared network location. Once executed, the attacker could gain full code execution privileges, making this a serious threat to any system that can receive Word files over the network.