A heap‑based buffer overflow exists in Microsoft Office Word that allows an unauthorized attacker to trigger the overflow and execute arbitrary code locally, thereby threatening the confidentiality, integrity, and availability of the affected system. The flaw is categorized as CWE‑122, indicating an uncontrolled buffer overflow that permits code injection.

The affected products are Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. Precise version details are not provided in the CNA data, so all current deployments of these products are considered at risk.

The CVSS score is 7.8, indicating a high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local; an attacker must deliver a crafted document or otherwise gain execution on a user’s machine to trigger the heap overflow.