Use‑after‑free flaw in Microsoft Office Excel lets an attacker execute arbitrary code over the network. The vulnerability arises when a valid memory pointer is freed but still accessed, allowing the attacker to inject malicious payloads that are processed by Excel. The ability to run code remotely means an adversary could gain control of the victim’s system, exfiltrate data, or install malware, thereby compromising confidentiality, integrity, and availability of the affected environment.

Microsoft 365 Apps for Enterprise, Microsoft Excel 2016, Microsoft Office 2019, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024. No specific version numbers are listed in the data, so all releases in the mentioned product families may be impacted.

The CVSS score of 8.8 classifies the flaw as high severity, while the EPSS score is not provided. The vulnerability is not currently listed in the CISA KEV catalog, but the description indicates that exploitation can occur over a network connection. The likely attack vector is that an attacker sends a crafted Excel file to a target connected to the same network, triggering the use‑after‑free and enabling code execution.