Code execution via untrusted pointer dereference

Untrusted pointer dereference in Microsoft Office allows attackers to execute code locally via unspecified vectors. Microsoft has not disclosed the affected Office component or trigger; the public record goes no further than a CWE-822 mapping, meaning Office accepts a value from untrusted input and dereferences it as a pointer. The published CVSS 3.1 vector requires local reachability and user interaction with no prior privileges, so exposure depends on getting a user to open or otherwise process attacker-controlled content.