A heap-based buffer overflow in Microsoft Office Outlook enables an attacker to execute arbitrary code on a target system when a malicious document or message is processed. The vulnerability is a classic example of CWE-122, where unchecked memory writes can corrupt heap structures. If successfully exploited, the attacker gains the same privileges as the Outlook process, potentially compromising confidential data, system integrity, or availability.

The affected products are Microsoft 365 Apps for Enterprise and the long-term servicing channel versions of Microsoft Office LTSC 2021 and LTSC 2024. Specific version details are not listed, so all current builds of these products should be evaluated for the presence of the flaw.

The CVSS score of 9.8 indicates a critical severity. The EPSS score is 1%, indicating a very low but non-zero exploitation probability, yet the high severity remains an urgent threat. The vulnerability is not currently in the CISA KEV catalog. The flaw is accessed over a network, inferring that an attacker can trigger it by sending a crafted email or malicious document. The combination of high CVSS score and remote reach makes it a top priority for remediation.