A heap‑based buffer overflow exists within Microsoft Office Word that allows an unauthorized attacker to execute arbitrary code over a network. The flaw does not require any credentials or user interaction; the attacker can trigger the overflow by delivering a crafted payload. Successful exploitation gives the attacker the ability to run native code with the privileges of the user process, potentially compromising the confidentiality, integrity, and availability of the affected system.

The vulnerability affects Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. This includes all desktop editions of Office for Windows and macOS that are part of those support channels.

The CVSS score of 8.8 classifies this flaw as high severity. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog, indicating no known public exploitation yet. The likely attack path is via network delivery of a crafted document to a vulnerable instance of Word, without requiring authentication. The absence of credential requirements and the remote nature of the attack suggest that unauthenticated attackers can exploit this flaw if they can reach the target machine.