Use after free in Microsoft Office Excel enables an attacker to execute arbitrary code locally with the privileges of the user running Excel. The flaw occurs when a crafted workbook causes Excel to free memory prematurely, allowing the attacker to control execution flow. Successful exploitation can lead to data theft, file modification, or system compromise depending on the user’s rights.

Microsoft 365 Apps for Enterprise, Microsoft Excel 2016, Microsoft Office 2019, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021 and 2024, and Office Online Server are impacted. Specific patch releases are not enumerated in the supplied data; administrators should consult the Microsoft Security Update Guide for the applicable cumulative update.

The CVSS score of 7.8 and an EPSS score below 1% indicate a high impact but a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The description indicates exploitation requires an attacker to supply a malicious spreadsheet that the user opens, and it is inferred that this makes the attack vector local and dependent on user interaction with a crafted file. Despite the limited reach, the severity warrants prompt remediation.