A dereference of an untrusted pointer within Microsoft Office Excel permits an attacker who can supply or influence input to cause execution of arbitrary code on the local machine. The flaw is classified as CWE‑822, representing an unsafe pointer dereference that can lead to remote code execution when the software processes malicious data.

The vulnerability affects multiple Microsoft Office products, including Microsoft 365 Apps for Enterprise, Microsoft Excel 2016, Microsoft Office 2019, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, the macOS versions of Office LTSC 2021 and 2024, and Office Online Server. Any user running these products with a local file containing malicious input is potentially impacted.

The CVSS score of 7.8 reflects a high severity, but the EPSS score indicates a very low likelihood of exploitation (less than 1%). The vulnerability is not currently listed in CISA’s KEV catalog. The likely attack vector involves an attacker creating or delivering a malicious workbook that, when opened locally, triggers the pointer dereference. No additional preconditions or privilege requirements are described in the advisory, suggesting that local execution is sufficient for the exploit to succeed.