This vulnerability exploits untrusted input in a security decision within Microsoft Word, permitting a local attacker to bypass a built‑in security feature. The bypass undermines the intended protection and may allow malicious documents to be processed with elevated privileges, compromising the integrity of the application and any content it handles.

Affected products include Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. Specific version numbers are not disclosed in the CVE entry, but all listed releases are impacted.

The CVSS score is 7.8, classifying the flaw as high risk. EPSS information is unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation at this time. The likely attack vector is local; an attacker who can run code on the target machine or supply a malicious document to a user can trigger the feature bypass. The vulnerability requires local access or user interaction and does not appear to allow remote exploitation.