The vulnerability is a null pointer dereference in Microsoft Office Word that permits an attacker to execute arbitrary code without authorization. Because the flaw is triggered by processing a specially crafted document, exploitation can result in full compromise of the victim’s system, including theft, data modification, or installation of additional malware. The weakness is classified as CWE‑476.

Microsoft 365 Apps for Enterprise, Microsoft Office 2019, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, Microsoft Word 2016.

The CVSS score of 8.8 indicates high severity, although the EPSS score is not available and the vulnerability is not yet listed in CISA’s KEV catalog. The likely attack vector is over a network: an attacker must craft and deliver a malicious Word document to a user or system that can open it. Successful exploitation does not require special user‑level privileges—any user who opens the infected file can trigger the exploit, leading to code execution with the victim’s account rights and the potential for lateral movement within the network.