A heap-based buffer overflow exists in Microsoft Office Word, enabling an unauthorized attacker to execute arbitrary code across the network. The vulnerability permits full control of the victim’s system when a crafted document is processed, potentially compromising confidentiality, integrity, and availability of the affected machine. The vulnerability is identified as a CWE‑122 heap‑based buffer overflow.

Affected products include Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. Version data is not specified in this CVE, so the exact release scope remains unspecified.

The vulnerability carries a high CVSS score of 8.8, indicating substantial impact if exploited. With no EPSS data available and the vulnerability not listed in CISA’s KEV catalog, the precise likelihood of active exploitation remains uncertain; however, the heap overflow and network‑based trigger suggest that any user who receives a malicious Word file could be compromised. Active exploitation would require the attacker to deliver a malformed document to the target device, a scenario that is plausible for phishing or compromised internal processes.