An use‑after‑free flaw in Microsoft Office Excel permits an attacker to execute arbitrary code locally. The vulnerability is a classic memory management error (CWE‑416) that can be triggered by a specially crafted Excel workbook, giving the attacker control over the target system’s code execution path and potentially compromising confidentiality, integrity, or availability of the host.

Affected products include Microsoft 365 Apps for Enterprise, Microsoft Excel 2016, Microsoft Office 2019, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and Office Online Server. Specific version information is not provided in the available data, so all current releases of these products are considered susceptible.

The CVSS base score of 7.8 indicates high severity, and the vulnerability is not listed in the CISA KEV catalog. Exploitation is likely limited to a local context, requiring that an attacker have access to a user’s machine or the ability to deliver a malicious workbook. No EPSS data is available, but the use‑after‑free nature and lack of mitigations suggest that once the flaw is triggered, code execution is practically guaranteed on the affected system.