This CVE records a classic use‑after‑free flaw in Microsoft Office Excel (CWE‑416) that allows an unauthorized attacker to execute code with the privileges of any user running Excel. The Microsoft description states that the attacker can trigger the vulnerability over a network, implying that delivery of a malicious workbook or document can lead to exploitation. The primary impact is remote code execution, potentially compromising system security, data confidentiality, or integrity.

All current installations of Microsoft 365 Apps for Enterprise, Office 365 for Mac, Office LTSC 2021, Office LTSC 2024, Office LTSC for Mac 2021, Office LTSC for Mac 2024, and Office Online Server are impacted. No specific patch level is provided, so the flaw remains present until a Microsoft update is applied.

The CVSS score of 8.8 classifies the vulnerability as high severity. The EPSS score is not available, and the CVE is not listed in the CISA KEV catalog, suggesting no known active exploitation yet. Nonetheless, the remote nature of the attack – requiring delivery of malicious content over a network – combined with the high severity means that organizations should treat this flaw as a priority. Until a patch is applied, the vulnerability could allow an attacker to run arbitrary code on any system where Excel is in use.