This vulnerability is a stack-based buffer overflow in Microsoft Office Outlook. It enables an unauthorized attacker to execute arbitrary code on the affected system when a specially crafted message is processed. Because it exploits a stack buffer, it can lead to complete compromise of the user’s machine, granting an attacker full control over the Office process and potentially the operating system. The weakness is categorized as CWE-121: Stack-based Buffer Overflow.

Affected products include Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021 and Microsoft Office LTSC 2024. The vulnerability is present in the Outlook component of these applications. No further version detail is specified beyond the overall product family.

The vulnerability carries a CVSS score of 8.8, indicating high severity. No EPSS score is available, so the current likelihood of exploitation cannot be quantified. It is not listed in the CISA KEV catalog, suggesting no confirmed live attacks yet. The attack vector is inferred to be remote over the network, where an attacker can send a malicious email or document to a user’s Outlook client. Exploitation would require the target to open or preview the crafted content, after which the stack overflow can be triggered.