The vulnerability is a use‑after‑free flaw in Microsoft Office Excel that permits an unauthorized attacker to cause arbitrary code execution when a malicious file is opened over a network. This weakness is classified as CWE‑416. Because the flaw resides in memory management, successful exploitation can compromise the confidentiality and integrity of the affected system, providing an attacker full control over the host machine.

Microsoft has identified several affected Office clients: Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and Office Online Server. The flaw applies to the specified long‑term servicing channel releases and their Mac counterparts, but no specific patch versions are listed in the data.

The flaw carries a CVSS score of 8.8, indicating high severity. The EPSS score is not available, so the current probability of exploitation cannot be quantified, but the potential impact warrants concern. The vulnerability is not listed in the CISA KEV catalog. Attackers would likely need a network‑accessible malicious file or can embed the payload in a shared document. The vector is inferred to be remote, as the description states execution over a network, though the exact prerequisites are not detailed in the official advisory.