A heap‑based buffer overflow in Microsoft Office Excel permits an attacker without authentication to execute arbitrary code over a network. The flaw is caused by a misuse of dynamic memory which can be triggered by a specially crafted spreadsheet, allowing the attacker to supply data that overflows an internal buffer. The resulting arbitrary code execution could compromise confidentiality, integrity, and availability of affected systems, escalating to full control of the host.

The vulnerability affects Microsoft Office products on both Windows and macOS: Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021 and Microsoft Office LTSC for Mac 2024. All installations of these editions using the specified 2021 and 2024 releases are considered vulnerable.

The CVSS score of 8.8 marks the flaw as a high‑severity threat; the EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog. Attackers could exploit the flaw remotely by delivering a malicious workbook over a network connection, making the risk relevant for environments that allow untrusted spreadsheet files to be opened. Given the high impact of arbitrary code execution, immediate patching is required.