Low score, real attacks. Microsoft rates the bug Moderate, CVSS 6.5, because the victim has to open the file; the Preview Pane alone doesn't trigger it. Microsoft hasn't described the attacks it saw. Tenable notes the advisory credits a researcher who used Anthropic's Claude to find it.
Why a hash matters. An NTLMv2 hash isn't the password, but it's close enough. Attackers can try to crack it offline, or relay it live to anything inside the network that still accepts NTLM logins, such as Exchange, LDAP or file shares, and act as that user. Phishing with booby-trapped attachments is the usual way this class of bug gets used.
What's affected. Microsoft 365 Apps for Enterprise (32- and 64-bit), Office LTSC 2024 (fixed in build 16.0.17932.21140) and Office LTSC 2021 (fixed in build 16.0.14334.21048). Microsoft 365 Apps Current Channel picks up the fix in build 20527.20196.
The rest of the drop. It's a huge month: SecurityWeek counts 1,094 fixes, Tenable 1,093 CVEs (63 rated critical), and BleepingComputer 1,235 flaws, with Outlook the only one flagged as exploited. Counts differ because trackers include different products and third-party CVEs.
What to do. Push the Office update now and force a relaunch rather than waiting for the maintenance window. Where you can't, block outbound SMB (TCP 445 and 139) to the internet, use Group Policy to audit and then deny outgoing NTLM to remote servers, and enforce SMB signing so a stolen hash can't be relayed to internal servers.