Code execution via heap-based buffer overflow

Heap-based buffer overflow in Microsoft Office Word in Microsoft Office and Outlook allows attackers to execute code via unspecified vectors. Microsoft and the public CNA record identify the flaw only as a heap-based buffer overflow in the Word component and do not disclose the parser, file format element, or memory operation that overruns a heap buffer. Published scoring shows no privileges are required but user interaction is required on a local system, so exposure is bounded to workflows that let untrusted content reach a vulnerable Office or Outlook installation.