The heap‑based buffer overflow in Outlook permits an unauthorized attacker to execute arbitrary code across the network. This flaw can grant the attacker complete control of the affected machine, compromising confidentiality, integrity, and availability. The weakness corresponds to a classic buffer overflow vulnerability (CWE‑122).

The vulnerability impacts Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024 on Windows. The CVE entry does not list precise version numbers, so all current releases of these products are potentially susceptible until the vendor releases a fix.

With a CVSS score of 9.8, the flaw is classified as critical. The EPSS score is not available, but the lack of an EPSS does not mitigate the high severity; attackers could target any Outlook installation that receives network traffic. Although not yet listed in CISA's KEV catalog, the high CVSS and the nature of the flaw suggest a high likelihood of exploitation by motivated adversaries. Successful exploitation would require the delivery of a crafted email or file processed by Outlook, making the attack vector remote over the network without needing local privilege escalation.