The vulnerability is a use‑after‑free flaw in Microsoft Office Excel that permits an unauthorized attacker to execute arbitrary code through a network‑based attack vector. The flaw originates from improper handling of memory after an object is freed, corresponding to CWE‑416. An attacker can exploit this by delivering specially crafted content to a vulnerable Excel instance, potentially gaining code execution rights with the privileges of the user running Excel.

Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024 are the products affected, as indicated by the CNA. Specific version numbers are not listed in the data, so all current builds of these packages are presumed vulnerable until the patch is applied.

The CVSS score of 8.8 labels the flaw as high severity, yet it has no EPSS score available and is not catalogued in CISA’s KEV list. While a concrete exploitation path is not detailed, the use‑after‑free nature suggests that the attack requires sending malicious content over a network to an active Excel session. Successful exploitation would grant an attacker full control over the host system, making this flaw highly critical if the environment allows such network interactions.