The vulnerability is an untrusted pointer dereference in Microsoft Office Excel that permits an attacker to execute arbitrary code on the target system. By leveraging this flaw, an unauthorized user can gain full control of the affected application, potentially compromising machine confidentiality, integrity, and availability. The weakness is classified as CWE‑822, indicating a flaw that allows manipulation of an internal pointer or reference.

Affected products include Microsoft 365 Apps for Enterprise, Microsoft Excel 2016, Microsoft Office 2019, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and Office Online Server. All listed versions are impacted; specific revision numbers are not supplied, but the vulnerability applies across the versions enumerated in the CNA product list.

The CVSS score of 7.8 signals high severity, while the EPSS score of less than 1% indicates a low probability of widespread exploitation at present. The flaw is not listed in CISA's KEV catalog, suggestive of limited known exploitation. Based on the description, the likely attack vector is local – an attacker must supply a malicious spreadsheet that a user opens. Once executed, the code runs with the privileges of the current Windows account, enabling full control of the affected system.