The issue is related to incorrect management of code generation when processing a COM object Graph in Microsoft Office and Microsoft Office Web Apps. This can be exploited by an attacker to execute arbitrary code using a specially crafted malicious file or a specially formed malicious web page.