Local code execution via undisclosed heap overflow

Heap-based buffer overflow in Microsoft Office allows local users to execute code by triggering vulnerable document processing. Microsoft has not disclosed the affected parser, input format, or heap allocation and copy operation that overruns the buffer. The attacker needs local access but no account privileges or user interaction, and successful exploitation runs code in the affected user’s context.