A heap-based buffer overflow vulnerability in Microsoft Word allows remote attackers to execute code, posing a high risk to organizational endpoints.

This is a heap-based buffer overflow (CWE-122) triggered within Microsoft Word. An unauthenticated attacker can exploit this via a network vector, though the attack typically requires user interaction.

Successful exploitation allows for remote code execution, which can lead to complete system compromise, unauthorized data access, and lateral movement within the network. With a CVSS score of 8.8, this vulnerability is classified as High severity, reflecting the potential for full loss of confidentiality, integrity, and availability of the affected host.

Immediate Action: Update affected Microsoft Office products to the specified fixed versions: 16.0.20326.20138 for 365 Apps, 16.0.10417.20207 for 2019, 16.0.14334.20906 for LTSC 2021, and 16.0.17932.20976 for LTSC 2024.

Proactive Monitoring: Monitor endpoint security logs for unusual process spawning from Winword.exe or unexpected network connections originating from Office applications.

Compensating Controls: Deploy endpoint detection and response (EDR) solutions to identify and block malicious document execution patterns and utilize network filtering to restrict suspicious outbound traffic.

Public Exploit Available: Unknown

Given the capability for remote code execution and the high CVSS score, organizations should prioritize patching all affected Microsoft Office installations. Please ensure that the latest security updates are applied across all enterprise workstations to mitigate the risk of exploitation.