A heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. The overflow occurs when a maliciously crafted document is processed, enabling the attacker to run arbitrary code with the privileges of the user running Office. This is a serious vulnerability classified as CWE–122 and carries a CVSS score of 8.8, indicating moderate to high potential for compromise.

The vulnerability affects multiple Microsoft Office product lines: Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Office LTSC 2021 and 2024, as well as their Mac counterparts for the Long Term Servicing Channel. Specific version numbers are not listed in the data, so any installation of these editions should be treated as potentially vulnerable until confirmed patched.

The CVSS score signals significant risk, and the lack of an EPSS entry means no current data on exploit frequency is available. The vulnerability is not catalogued in CISA's KEV list, but its high severity and ability to be exploited over a network present a clear threat. An attacker could target users with remote access or send malicious documents via email or shared network locations, which Office would process automatically, leading to code execution. All users of the affected Office editions are therefore at risk until the issue is remediated.