A heap‑based buffer overflow was discovered in Microsoft Office Word. The flaw allows an attacker who can deliver a specially crafted document to a victim to corrupt memory and execute arbitrary code with the privileges of the user running the application. The description indicates that the attacker need not have local access; the vulnerability can be exposed over a network connection. This can lead to full compromise of the affected machine, data theft, or lateral movement within the environment if the victim holds administrative rights.

The flaw impacts multiple Microsoft Office deployments, including Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. All these are affected across their Windows and macOS editions where Office Word is deployed. No specific version numbers are listed in the CNA, and the CVE does not delineate a narrower scope than the products mentioned.

The CVSS score of 8.8 marks it as high severity. The EPSS score is not available, so current exploit probability cannot be quantified, but Microsoft has not reported it as a known exploited vulnerability. Attackers would need to craft a malicious document and deliver it over a network channel such as email or shared network drive. The lack of a publicly known exploit means the risk is theoretical but still significant due to the high impact potential.