The CVSS 7.8 rating on this heap-based buffer overflow in Microsoft Office deserves skepticism, but not for the obvious reason. The 'local attacker' qualifier masks a more consequential question: which forgotten parsing code path does this actually touch?
Heap overflows in Office cluster in specific subsystems — the RTF parser, equation editor, and legacy DOC/XLS binary handlers share a common genetic signature. Each vulnerability in this lineage typically involves an object lifetime issue combined with insufficient bounds checking on size calculations that assume trusted input. This isn't random; it's structural. Exploit brokers and nation-state actors maintain internal trackers mapping which parser subsystems haven't been audited since which Office version. The low EPSS score (0.00359) measures public weaponization probability, not whether sophisticated adversaries have already reverse-engineered the patch and identified adjacent issues in the same code path.
The practical question isn't whether an attacker with code execution can trigger this — it's whether the parsing layer is truly dormant between document opens. Office's update mechanisms, telemetry channels, and preview handlers load these parsers outside user-initiated sessions. If an attacker already has endpoint access through other means, this becomes a reliable pivot into the broader identity graph — Office processes maintain trusted relationships with SharePoint, Teams, Exchange, and Intune. The CVSS 7.8 measures endpoint severity, not the cascade through the collaboration stack.
Prioritize patching, but treat this as a signal to audit which users with Office have broad SharePoint or Teams permissions. That's where the blast radius lives, and that's what defenders should model.