A use‑after‑free bug in Microsoft Office Excel enables an attacker to execute arbitrary code. The flaw allows the execution of code that can compromise the confidentiality, integrity, and availability of the affected system, essentially granting full control to the attacker. The weakness falls under CWE‑416 (Use After Free).

Microsoft 365 Apps for Enterprise, Microsoft Excel 2016, Microsoft Office 2019, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and Office Online Server are all impacted. Patching is required for all versions listed.

The CVSS score of 7.8 indicates a high severity. Although an EPSS score is not available, the flaw’s high impact suggests that exploitation could occur if a malicious file is opened by a user. The vulnerability is not currently listed in CISA’s KEV catalog, but the lack of a public exploit does not reduce the risk, as the attack can be achieved through a crafted Office document. A Microsoft patch is available; applying it removes the use‑after‑free condition and the ability for code execution.