The vulnerability is a heap‑based buffer overflow in Microsoft Office Word that permits an unauthorized attacker to execute code locally on an affected machine. The flaw falls under CWE‑122, which highlights uncontrolled memory writes that can hijack program flow. Successful exploitation would give the attacker the ability to run arbitrary code with the privileges of the current user, potentially escalating privileges or compromising data integrity. The description does not explicitly state remote code execution, only local execution, so the impact remains confined to the target system.

Microsoft products listed as affected include Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021 and Microsoft Office LTSC for Mac 2024. No specific version ranges are provided; the known CPEs collectively indicate the latest long‑term servicing channel releases for 2021 and 2024, as well as the 2024 Desktop Office for Mac.

The CVSS score of 7.8 indicates a high severity vulnerability that could lead to serious local compromise. EPSS is not available, so the current exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, which suggests that verified exploits are not widely observed yet. Based on the description, the likely attack vector is local; an attacker must have access to the user session or a malicious document that the user can open. Without remote vectors or social engineering details, the exploit remains a local privilege escalation/compromise scenario.