Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute arbitrary code over a network, allowing compromise of confidentiality, integrity, and availability of the affected system.

Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024 are affected versions of Office Word.

The CVSS score of 9.8 indicates critical severity. The exploit probability is unknown due to missing EPSS data, and the vulnerability is not yet listed in CISA's KEV catalog. Based on the description, the likely attack vector is remote over a network, possibly by delivering a crafted document or attachment. This flaw could allow a remote attacker to take full control of a vulnerable system.