A heap-based buffer overflow has been discovered in Microsoft Office Excel that permits an unauthenticated attacker to execute arbitrary code over a network. The flaw originates from improper handling of memory allocation when parsing Excel files, as classified by CWE-122. Successful exploitation can lead to complete compromise of the affected system, allowing the attacker to run arbitrary code and potentially move laterally within the network.

Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and Office Online Server are all impacted by this vulnerability, regardless of the specific version edition.

The CVSS score of 8.8 indicates a high severity, while the EPSS score is not currently available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is network-based, requiring delivery of a maliciously crafted Excel file to the target system. If the user opens or processes the file, the heap overflow can be triggered, enabling code execution with the privileges of the Office process. Exploitation is only possible against the affected Office versions, and no publicly available proof‑of‑concept or exploit frameworks have been reported at this time.