A heap-based buffer overflow in Microsoft Office Excel enables an unauthorized local attacker to increase their process privileges, potentially allowing them to execute arbitrary code with elevated rights. The vulnerability is rooted in improper bounds checking of memory writes, as indicated by the associated CWE-122 and CWE-787 weaknesses.

The flaw affects various Microsoft Office products, including Microsoft 365 Apps for Enterprise, Microsoft Excel 2016, Microsoft Office 2019, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, and Office Online Server. Specific version details are not enumerated in the CVE record, so all releases of these products should be considered potentially vulnerable until a vendor advisory specifies otherwise.

With a CVSS score of 7.8, the vulnerability presents a considerable severity, yet its EPSS score of less than 1% indicates that exploitation opportunities are currently rare. The flaw is not listed in the CISA KEV catalog. The attack vector is local, requiring the attacker to obtain a crafted or malicious Excel workbook and have it opened on a target system. Successful exploitation would allow the attacker to elevate privileges to admin or system level on the affected machine.