A heap-based buffer overflow exists in Microsoft Office Excel, enabling an attacker to execute arbitrary code via the network. The flaw allows unauthorized code injection, giving the attacker full control over the affected system. The weakness corresponds to a classic memory corruption issue.

Microsoft products affected include Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and Office Online Server. Version details are not explicitly listed in the data.

The vulnerability carries a CVSS score of 8.8, indicating a high severity rating. EPSS data is not available, and the flaw is not currently listed in the CISA KEV catalog, suggesting that a publicly known exploit may not yet exist. The likely attack vector, inferred from the description, is an attacker delivering a malicious Excel file or document over a network connection to trigger the buffer overflow. Due to the high CVSS and the remote nature of the attack, the risk to affected systems is significant and warrants immediate attention.