Technical impact
Deserialization of untrusted input in Microsoft Office Publisher enables an attacker who can supply data over the network to execute arbitrary code on a vulnerable system. This flaw can be leveraged to compromise confidentiality, integrity, and availability of the affected machine at the privilege level of the Publisher process.
Affected Systems
The vulnerability affects Microsoft 365 Apps for Enterprise, Microsoft Office 2019, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, and Microsoft Publisher 2016. No specific version numbers are listed, but any installation of these products that has not applied the recent security update is potentially vulnerable.
Risk and Exploitability
With a CVSS score of 8.8 the vulnerability is considered high severity. The EPSS score is 1% and the issue is not listed in the CISA KEV catalog, but the nature of the flaw suggests that a network‑based attacker with the ability to supply malformed files could exploit it. Exploitation would require only network access to a file containing malicious serialized data; no local privilege escalation prerequisites are indicated in the provided description.
