A heap‑based buffer overflow in Microsoft Office Word can be triggered by data supplied over a network, allowing an attacker who can deliver a malicious Office document to execute arbitrary code with the victim’s privileges. The flaw results from improper bounds checking when processing user data, a weakness classified as CWE‑122 and CWE‑190, and can lead to full system compromise if the attacker gains execution. The vulnerability directly threatens confidentiality, integrity, and availability of affected workstations.

The flaw affects several Microsoft Office editions, including Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024 and their macOS counterparts. Any installation of these products that has not yet received the latest security update is vulnerable.

The CVSS score of 8.1 places this issue in the high‑severity range. Because no EPSS score is currently published, the exploitation probability cannot be quantified, but the vulnerability is not listed in CISA’s KEV catalog, suggesting no publicly known widespread exploitation yet. The likely attack vector is via a network transmission of a crafted Office document; an attacker must be able to deliver the file to the victim, which may occur through shared folders, email attachments, or other network‑shared locations. Once the vulnerable object is parsed, the overflow can be detonated to gain code execution.