Microsoft Office Excel is vulnerable to a use‑after‑free flaw that allows an unauthorised attacker to execute arbitrary code. The flaw arises when an object that has already been freed is accessed again, enabling the attacker to inject and run malicious payloads. This produces a severe impact on confidentiality, integrity, and availability of any affected system, as code can be run with the privileges of the logged‑in user. The vulnerability is identified as CWE‑416, a memory‑management error that can lead to arbitrary code execution.

This flaw affects Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. All users running these versions of Excel should verify whether they are exposed by checking the installed update level against Microsoft’s published security update for CVE‑2026‑100211.

The CVSS score of 8.8 indicates high severity. EPSS is not available, so the current exploitation probability is unknown, but the lack of an EPSS entry does not guarantee safety. The flaw is listed as not in the CISA KEV catalog, meaning widespread active exploitation has not yet been observed. Based on the description, the likely attack vector is remote, whereby an attacker sends a specially crafted Excel file to a user or exploits the flaw over a network share. If the user opens or processes the file, the memory corruption could be triggered, leading to execution of attacker supplied code. Mitigation requires applying the official Microsoft security update; until a patch is applied, systems remain vulnerable to this remote code‑execution risk.