The vulnerability arises from the use of an uninitialized resource within Microsoft Office Word, enabling an attacker who is not authenticated to execute arbitrary code over the network. This flaw corresponds to CWE‑908 and results in full remote code execution, compromising confidentiality, integrity, and availability of the affected system.

The issue affects Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. No specific version ranges are listed, implying that all current versions of these products may be vulnerable until an official fix is applied.

The CVSS score of 8.8 indicates a high severity, and although an EPSS score is not available, the vulnerability is actively exploitable over a network as the exploit requires no credentials. The defect is not yet catalogued in CISA's KEV list, but its remote code execution nature and high CVSS warrant immediate attention and patching.