The vulnerability is a heap‑based buffer overflow in Microsoft Office Excel that permits an attacker to execute arbitrary code over a network. The flaw allows malicious input to overwrite critical memory areas, giving the attacker control of the execution flow and the ability to run code with the privileges of the user who opens the workbook. This results in a complete loss of confidentiality, integrity, and availability for affected systems.

Affected products include Microsoft 365 Apps for Enterprise (Office 365), Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. Specific revision ranges are not supplied, but all current releases of these products are impacted.

The CVSS score of 8.8 indicates high severity, while the EPSS score is not available, meaning the exact exploitation probability is unknown. The vulnerability is not listed in CISA’s KEV catalog, so no known public exploits are cited. The likely attack vector is remote, where an attacker delivers a crafted Excel file over a network—either via email, file share, or other delivery mechanisms—and the victim opens it, triggering the buffer overflow and code execution.