A heap-based buffer overflow in Microsoft Office Word can be triggered by an unauthorized attacker who creates a specially crafted document. When a user opens the malicious file, the overflow leads to the execution of injected code on the local machine. The vulnerability is a classic case of CWE‑122, where improper buffer size handling allows the attacker to overwrite critical memory locations.

Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024 are all affected. These are the current deployments of Microsoft 365 and the long‑term servicing channel releases for Office 2021 and 2024. No specific sub‑versions are listed, so all revisions of these product lines are potentially vulnerable.

The CVSS score of 7.8 indicates a high impact if exploited. Because the EPSS score is not available, the current exploitation probability is unknown, but the lack of a KEV listing suggests no widespread public exploitation has been observed yet. The likely attack vector is local file execution: an attacker must supply a malicious Word document which the user opens, triggering the overflow and code execution. The risk is significant for organizations using these Office packages, especially where users routinely open documents from external sources.