A use‑after‑free bug in Microsoft Excel allows an attacker to execute code locally on the affected machine. The flaw can be triggered by opening a crafted Excel file, leading to arbitrary code running under the victim’s user account. The weakness is classified as CWE‑416, which indicates that memory is accessed after it has already been freed, enabling the attacker to exploit unpredictable program state.

Microsoft 365 Apps for Enterprise, Microsoft Excel 2016, Microsoft Office 2019, Microsoft Office LTSC 2021 and 2024, Microsoft Office LTSC for Mac 2021 and 2024 are all impacted. Version details are not specified in the advisory, implying the vulnerability exists across the listed releases.

The CVSS score of 7.8 marks this as a high‑severity issue. The EPSS score of less than 1% suggests that, as of the last assessment, exploitation is unlikely but not impossible. The vulnerability is not currently listed in CISA’s KEV catalog. Likely attack vectors involve a malicious Excel workbook or macro that a user opens locally, allowing the attacker to run arbitrary code on the machine.