A use‑after‑free flaw in Microsoft Office Excel can allow an unauthorized local attacker to execute code when a crafted Excel file is opened, granting the attacker the privileges of the user running the application. This weakness is a use‑after‑free (CWE‑416) and carries a CVSS base score of 7.8, which places it in the high‑severity range. The impact is local code‑execution that can compromise the confidentiality, integrity, and availability of the affected system.

Vendors Microsoft and products including Microsoft 365 Apps for Enterprise, Microsoft Excel 2016, Microsoft Office 2019, Microsoft Office LTSC 2021 and 2024, Microsoft Office LTSC for Mac 2021 and 2024, and Office Online Server are affected. All listed product families are considered vulnerable, though specific patch versions are not identified in the available data.

The high CVSS score indicates a serious risk, but exploitation requires the victim to open a malicious Excel document, suggesting the attack vector is likely a supply‑chain or social‑engineering delivery of a crafted file. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, so widespread exploitation is uncertain, yet the potential damage is significant if the flaw is exploited.