Microsoft Office Word contains a heap-based buffer overflow that allows an attacker to execute arbitrary code. The vulnerability permits unauthorized execution of malicious code, which can compromise confidentiality, integrity, and availability of the affected system. The weakness is classified as CWE‑122. The impact is a complete compromise of the target machine if exploited.

The security advisory lists Microsoft 365 Apps for Enterprise, Microsoft Office 2016, Office 2019, Office 2021, Office 2024, Office LTSC 2021, LTSC 2024, Office 365 for Mac, Office LTSC for Mac 2021, and Office LTSC for Mac 2024 as affected. All current builds and servicing channels of these products are vulnerable; no specific patch versions are detailed in the data provided.

The CVSS base score of 8.8 indicates high severity. The EPSS score is not available, and the vulnerability is not yet listed in the CISA KEV catalog. Based on the description, the likely attack vector is via the network, where an attacker sends a malicious Word document to an unsuspecting user or opens a remote file that triggers the overflow. Exploitation would grant the attacker code execution on the victim’s machine.