Local code execution via stack overflow

Stack-based buffer overflow in Microsoft Office Word in supported Microsoft Office releases allows attackers to execute code locally. Microsoft has disclosed only that Word overruns a stack-allocated buffer; the public record does not identify the vulnerable parser, routine, or the specific operation that copies attacker-controlled data onto the stack. Microsoft’s CVSS assessment indicates no prior privileges are required but user interaction is, so reachability depends on getting code on the target system to open or otherwise process malicious Word content.