A use‑after‑free flaw in Microsoft Office Word enables an attacker who can send crafted content over the network to execute arbitrary code in the context of the current user. The vulnerability can result in full system compromise and is classified as a remote code execution risk. The weakness is a classic memory corruption error (CWE‑416).

The flaw affects numerous Microsoft Office products, including Microsoft 365 apps for Enterprise, Office 2019, Office 365 for Mac, Office LTSC 2021 and LTSC 2024, Office LTSC for Mac 2021 and 2024, and Word 2016. Detailed version information is not provided in the citation, so all releases listed in the vendor products are potentially impacted.

The CVSS score of 8.8 indicates a high‑severity exploit. EPSS data is not available, and the issue is not currently listed in the CISA KEV catalogue. The vulnerability can be triggered by an unauthenticated attacker sending malicious content over a network connection to a vulnerable Office installation; the likely attack vector is remote, potentially via an email attachment or shared network location. Given the nature of the flaw, a successful exploit grants the attacker arbitrary code execution on the host, posing a significant risk to confidentiality, integrity, and availability.