The stack-based buffer overflow in Microsoft Office Word permits an authorized local user to gain higher privileges. The flaw stems from improper bounds checking, which could allow a crafted document to overflow the stack. Exploiting it could let the attacker execute arbitrary code with elevated privileges, providing full control over the affected machine. This is a typical stack-based buffer overflow (CWE‑121) and numeric overflow (CWE‑197) resulting in privilege escalation.

All versions of Microsoft Office that fall under the listed Microsoft 365 Apps for Enterprise, Office 365 for Mac, Office LTSC 2021, Office LTSC 2024, and their Mac equivalents are affected. The vulnerability is present across both Windows and MacOS versions of the listed Office suites.

The CVSS score of 7.8 indicates a high severity. The EPSS score is not available, so the likelihood of exploitation is uncertain but could be moderate. The vulnerability is not listed in CISA's KEV catalog. It requires the attacker to already be logged on to the system, so the attack vector is local. An authorized user could open a malicious document to trigger the buffer overflow and gain administrative privileges.