The flaw is a heap‑based buffer overflow in Microsoft Office Outlook that allows an attacker without prior access to a device or user credentials to trigger arbitrary code execution over a network connection. Once exploited, the attacker can gain full control of the affected system, enabling lateral movement, data exfiltration, or installation of malware.

The vulnerability affects Microsoft 365 Apps for Enterprise and Microsoft Office LTSC 2024. Specific patch level detail is not provided, but any installation of these product families at the time of the advisory is potentially vulnerable.

The CVSS score of 8.8 reflects a high severity and indicates a high impact. EPSS is currently not available, which limits the ability to gauge exploitation likelihood, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploitation in the wild. The attack vector is inferred to be remote over a network, as the description indicates code execution via a network connection. System administrators should consider this privilege escalation risk a high priority.