A heap-based buffer overflow in Microsoft Office Outlook enables an attacker who is not already authenticated to run arbitrary code. The flaw originates from improper handling of memory structures and is classified as CWE-122. If leveraged, an adversary could take full control of the Outlook process, potentially compromising data, installing malware, and spreading to other systems.

The vulnerability affects Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021 and Microsoft Office LTSC 2024. Specific version numbers that contain the flaw are not supplied in the advisory, so any deployment of the affected product line should be considered at risk until a patch is applied.

The CVSS score of 8.8 indicates a high severity level. EPSS data is not available and the issue is not listed in CISA’s KEV catalog, suggesting no known active exploitation yet. Based on the description, the attack vector is likely a network-based exploit that can be triggered via a crafted message or MAPI interaction by an unauthenticated attacker.