A heap-based buffer overflow vulnerability in Microsoft Word poses a critical risk of remote code execution for users of Microsoft 365 and Office suites.

This flaw is a heap-based buffer overflow (CWE-122) within Microsoft Office Word. It allows an unauthenticated attacker to trigger code execution over a network, typically requiring user interaction to open a specially crafted file.

The ability for an unauthenticated attacker to execute arbitrary code on a user workstation presents a severe risk of data breach, lateral movement within the corporate network, and full system compromise. With a CVSS score of 8.8, this vulnerability is classified as High severity, reflecting the potential for total loss of confidentiality, integrity, and availability of the affected system.

Immediate Action: Review the Microsoft Security Update Guide at the provided link and apply all relevant patches for the specific Office product version in your environment immediately.

Proactive Monitoring: Monitor endpoint detection and response logs for suspicious child processes spawning from Winword.exe, such as PowerShell or command shell execution.

Compensating Controls: Ensure that Office macro security policies are strictly enforced and consider utilizing attack surface reduction rules to block Office applications from creating child processes.

Public Exploit Available: Unknown.

Given the severity of potential remote code execution, security teams must prioritize the deployment of Microsoft security updates across all endpoints running the affected Office software. Organizations should ensure that all users have received the latest security patches to mitigate the risk of exploitation.