Microsoft Office contains a heap‑based buffer overflow that allows an attacker to inject and execute arbitrary code when a vulnerable document is processed. This flaw can be triggered remotely over a network, granting the attacker full control over the affected system and exposing the attacker to complete compromise of confidentiality, integrity, and availability.

The vulnerability affects Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. All installations of these products that have not yet received the Microsoft patch are susceptible.

The CVSS score of 8.8 indicates a high severity vulnerability. Although an EPSS score is not available, the entry is not listed in the CISA KEV catalog, implying that known exploitation is not yet confirmed. The likely attack vector is a network‑based attack, where an unauthorized actor sends a crafted document or payload to the victim's Office application to trigger the heap overflow and execute arbitrary code. The impact is significant, potentially allowing attackers to exfiltrate data, manipulate or delete data, or further spread malware within the network.