The vulnerability is a stack‑based buffer overflow in a Microsoft Graphics Component used by Office for Android, corresponding to CWE‑121. An attacker supplies an oversized input that corrupts memory on the stack, allowing execution of code with the privileges of the user running the application. This flaw enables an elevation of privilege: an attacker who can exploit the buffer overflow can gain higher privileges on the device, potentially accessing or modifying sensitive data and executing arbitrary code.

Microsoft Office for Android is affected. No specific version range is listed, so all installations of Office for Android that include the graphics component at the time of disclosure are potentially vulnerable.

The CVSS score of 8.0 indicates high severity. The EPSS score is not available, so the likelihood of exploitation in the wild cannot be quantified. It is not listed in CISA’s KEV catalog, implying no known widespread exploitation. Based on the description, the likely attack vector is a network-based interaction requiring an authorized user context, enabling the attacker to trigger the overflow by interacting with Office over a network connection.