The vulnerability is a stack‑based buffer overflow in Microsoft Office Word that allows an attacker to cause arbitrary code execution by delivering a specially crafted document. The flaw can lead to full compromise of the affected system, exposing confidential data, modifying files, or installing additional malware, all under the victim’s user privileges.

Affected products include Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. All current releases of these editions are impacted until patched.

The vulnerability has a CVSS score of 8.8, indicating high severity. The EPSS score is not available, and it is not listed in the CISA KEV catalog. The likely attack vector is network delivery of a malicious Word document, as an unauthorized attacker can trigger the overflow remotely when the victim opens the crafted file. No additional exploitation prerequisites are disclosed by the vendor.