A heap-based buffer overflow exists in Microsoft Office that permits an attacker to execute arbitrary code within the context of the vulnerable application. This flaw is exposed when Office processes a specially crafted file received over a network connection, allowing the attacker to gain control of the victim’s system. The weakness is categorized as CWE-122 and can compromise the confidentiality, integrity, and availability of the affected machine.

Microsoft Office products impacted by this vulnerability include Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. Specific affected versions are not listed in the current advisory, but any installation of these product lines that has not applied the latest security updates remains at risk.

The flaw carries a CVSS score of 8.8, indicating a high severity for remote code execution. The EPSS score is not available, so the exact likelihood of exploitation cannot be quantified, and the vulnerability is not currently listed in CISA’s KEV catalog. Based on the description, it is inferred that the attack vector involves an unauthorized attacker delivering a malicious Office document over the network, such as through email, shared folder, or other remote file transfer. If the victim’s Office application processes the file without the latest patch, the attacker can execute code in the user’s context, potentially granting full system compromise.