Use‑after‑free in Microsoft Office Excel permits an attacker to execute arbitrary code when the victim opens a specially crafted workbook. The flaw involves a heap memory bug identified as CWE‑416, allowing unauthorized code execution that compromises confidentiality, integrity, and availability of the affected system.

Microsoft 365 Apps for Enterprise, Microsoft Excel 2016, Microsoft Office 2019, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and Microsoft Office Online Server. All supported variants of these products are impacted, including 32‑bit, 64‑bit, and MacOS builds as referenced in the affected CPEs.

The CVSS score of 7.8 indicates a high severity risk, while the EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog, but the attack vector is likely via a malicious Excel file that a user opens—either through email, download, or network share. No public exploit is confirmed, but the flaw can be leveraged by attackers with access to a target’s desktop to run arbitrary code with user privileges.