A heap‑based buffer overflow in Microsoft Office Excel enables an attacker without prior authorization to run arbitrary code on the host system via a network‑based trigger. The flaw stems from improper handling of data structures, allowing the attacker to overwrite control‑flow information and thus gaining full compromise of the machine. This leads to loss of confidentiality, integrity, and availability of the affected workstation or server.

The flaw affects Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and Office Online Server, deployed on Windows, macOS, and server platforms.

The CVSS score of 8.8 indicates high severity, while the EPSS score is unavailable, suggesting no publicly reported exploitation at this time. The vulnerability is not listed in CISA KEV. Based on the description, it is inferred that an attacker would need to transmit a specially crafted Excel file over a network; opening that file triggers the heap overflow and grants code execution. The lack of publicly known workarounds means that protection must rely on securing the environment and applying any available vendor fixes.