The vulnerability is a heap-based buffer overflow in Microsoft Office Word that permits an unauthenticated attacker to execute arbitrary code on a target system. Because the flaw can be triggered over a network connection, it threatens the confidentiality, integrity, and availability of affected computers. The weakness is identified as a classic Buffer Overflow (CWE-122).

Affected products include Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. No specific patch versions are listed in the entry, so all releases of these products that contain the vulnerable code are potentially impacted.

The CVSS score of 8.1 indicates a high severity. The EPSS score is not available, so the current exploitation probability cannot be quantified, but the nature of the vulnerability allows remote exploitation without user interaction. It is not listed in CISA KEV, suggesting no known industrial exploitation, yet the high CVSS warrants careful attention. An attacker could gain full control of the target machine if the vulnerability is successfully triggered from a network source.