A heap‑based buffer overflow in Microsoft Office Outlook enables an unauthorized attacker to execute arbitrary code over the network. The flaw arises from improper handling of data that causes a memory overwrite, allowing the attacker to inject malicious code into the process. This type of vulnerability is classified under CWE‑122 and CWE‑190, reflecting unchecked buffer and integer operations that compromise confidentiality, integrity, and availability of affected systems.

The vulnerability affects Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024. All installations of these products are impacted regardless of user role, as the overflow can be triggered by receiving a specially crafted document or email via Outlook.

The CVSS score of 8.8 categorizes the vulnerability as high severity, and the lack of an EPSS score does not diminish the potential for exploitation. The flaw can be reached remotely over the network, making it suitable for widespread attacks. The vulnerability is not currently listed in CISA’s KEV catalog, but the high CVSS score and remote nature warrant immediate attention.