The vulnerability is a heap-based buffer overflow in Microsoft Office Word that allows an attacker to execute arbitrary code on a target system. The flaw is consistent with CWEs 122 and 190, representing buffer overflow and signed integer overflow weaknesses. Because code execution is possible, an attacker could gain full system compromise, affect confidentiality, integrity, and availability of the affected machine.

Affected products include Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. Specific version numbers are not listed, but any installation of these products may be vulnerable.

The CVSS score of 8.8 signals a high severity risk. EPSS information is unavailable and the vulnerability is not currently in the CISA KEV catalog, so current exploitation data is limited. The likely attack vector is remote: an unauthorized attacker can send a malicious document across a network, for example via shared location or email, which, when opened in Word, triggers the heap overflow and leads to code execution. Attacking conditions appear to require transmission of crafted content to a target Word instance running an affected version.