A critical heap-based buffer overflow vulnerability in Microsoft Office products could allow remote code execution, posing a significant risk to organizational endpoints.

The vulnerability is a heap-based buffer overflow (CWE-122) within Microsoft Office Word. It can be triggered by an unauthenticated attacker over the network, though it requires user interaction to open a malicious file.

Successful exploitation grants an attacker the ability to execute arbitrary code with the privileges of the logged-in user. This may lead to a complete system compromise, unauthorized data exfiltration, or the deployment of persistent malware. Given the high CVSS score of 8.8, this flaw represents a significant threat to internal network security and data integrity.

Immediate Action: Update all affected Microsoft Office installations to the specified fixed versions or newer as listed in the Microsoft Security Update Guide.

Proactive Monitoring: Monitor endpoint logs for abnormal process spawning originating from Microsoft Word, such as unexpected shell executions or network connections.

Compensating Controls: Utilize endpoint protection platforms to detect and block malicious document execution and ensure that macros are disabled or restricted via Group Policy.

Public Exploit Available: No — there is no evidence of a public exploit at this time.

This vulnerability presents a high risk of remote code execution and should be prioritized for immediate remediation. IT administrators should verify version numbers across the enterprise environment and deploy the necessary Microsoft security patches as soon as they are made available to prevent potential exploitation.