The vulnerability is a heap‑based buffer overflow in Microsoft Office Word that allows an unauthenticated remote attacker to execute arbitrary code by sending a specially crafted document over the network. This flaw can lead to full compromise of the targeted machine, as the attacker gains the ability to run malicious code with the privileges of the user running Word. The weakness is a classic example of CWE‑122, a heap overflow that can be abused when the interpreter mishandles user‑supplied data.

The affected products are Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. These comprise all supported Windows and macOS releases of Microsoft Office Word across the specified servicing channels, with the exact affected versions currently unspecified but reported to be vulnerable in the latest builds.

The CVSS score of 8.8 classifies this bug as high severity, but the EPSS score is not available, suggesting limited or unknown exploitation activity in the wild. The vulnerability is not listed in the CISA KEV catalog, indicating no confirmed widespread exploitation yet. The likely attack vector is a seemingly benign Word document received over the network—email attachment, shared network drive, or compromised download—which, when opened by a user, triggers the heap overflow and allows the attacker to run code remotely.