A stack‑based buffer overflow exists in Microsoft Office Excel that allows an unauthorized attacker on the local machine to execute code. Since the flaw operates within the Office process, exploitation can lead to full compromise of the affected user’s workstation, allowing data theft, persistence or lateral movement within the local environment.

Affected products include Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office 365 for Mac, Office LTSC 2021, Office LTSC 2024, Office LTSC for Mac 2021, and Office LTSC for Mac 2024. The vulnerability is reported for both Windows and macOS variants of these Office distributions.

The CVSS score of 7.8 indicates a high severity, but the EPSS score of less than 1% suggests a very low probability of current exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is inferred to be local, requiring the attacker to have access to a user’s account or to trick a user into opening a malicious spreadsheet. No remote or network‐based exploitation is described.