A heap-based buffer overflow in Microsoft Office Outlook enables an attacker who can deliver a crafted payload over the network to execute arbitrary code with the privileges of the user running Outlook. This flaw falls under CWE-122 and delivers a full remote code execution capability, compromising confidentiality, integrity and availability of the affected system.

The vulnerability affects Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021 and Microsoft Office LTSC for Mac 2024. All listed versions are impacted.

The CVSS score of 9.8 indicates a critical severity. The EPSS score of 1% indicates a very low but nonzero exploitation probability, and the vulnerability is not listed in CISA's KEV catalog, however the lack of public exploitation data does not lessen the high risk of exploitation. The attack vector is inferred to be network‑based and unauthenticated, as the description states that an attacker can execute code over a network.