The vulnerability is a use‑after‑free flaw in Microsoft Excel that allows an unauthorized attacker to execute code locally. This flaw can compromise confidentiality, integrity, and availability by running arbitrary code with the permissions of the current user.

Affected products include Microsoft 365 Apps for Enterprise, Microsoft Excel 2016, Microsoft Office 2019, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and Office Online Server. No specific version range is disclosed, so any install of these products is potentially vulnerable.

The CVSS score of 7.8 indicates substantial severity, and the EPSS score of 0.00062 indicates a very low but nonzero probability of exploitation. The vulnerability is not listed in CISA KEV. The heap overflow can be exploited by an attacker with local or privileged access to the system. Based on the description, it is inferred that the attack vector is local, requiring a user to open a crafted file or execute malicious code from within Excel. No public exploit has been reported, but the flaw’s nature warrants prompt mitigation.