The vulnerability reveals a heap‑based buffer overflow vulnerability in Microsoft Outlook that permits an unauthorized attacker to execute code locally. While the description does not provide further technical detail, the classification implies an attacker could execute arbitrary code on a system with the privileges of an interacting user.

Affected products include Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024, all of which contain the Outlook client. No specific build numbers are listed, so any current installation of these suites that includes Outlook is considered vulnerable until a fix is applied.

The CVSS score of 7.8 classifies this as high severity, indicating a significant risk if left unpatched. The EPSS score of < 1% implies that the probability of exploitation is low, and the vulnerability is not yet listed in CISA’s KEV catalog, suggesting that widespread exploitation has not been observed. Based on the nature of local code execution in the Outlook client, it is inferred that typical attack vectors might involve phishing or malicious attachments, though the primary description does not specify the exact exploit method; capable adversaries could exploit the defect to gain control over user systems.