The vulnerability is an untrusted pointer dereference in Microsoft Office Excel that enables an unauthorized attacker to execute arbitrary code locally. This results in a Local Code Execution flaw, potentially compromising the confidentiality, integrity, and availability of the affected system. The weakness aligns with CWE‑822.

Affected systems include Microsoft 365 Apps for Enterprise, Microsoft Excel 2016, Microsoft Office 2019, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and Office Online Server. Specific version details are not provided in the supplied data.

The CVSS score of 7.8 marks the issue as high severity, while an EPSS score of less than 1% indicates a low likelihood of exploitation. It is not listed in the CISA KEV catalog. The attack vector is inferred to be local, requiring an attacker with some level of interaction or access to execute this exploit. The absence of a remote trigger suggests that privileged or local access is necessary to exploit the untrusted pointer dereference.