The vulnerability is a heap-based buffer overflow in Microsoft Office Excel. An attacker who can deliver a specially crafted Excel file over a network can cause the application to execute arbitrary code on the victim’s system. The weakness, classified as CWE‑122, undermines the integrity of the Excel process, enabling an attacker to gain full control of the affected machine.

Affected products include Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and Office Online Server. All listed editions use the same underlying Excel engine and are vulnerable unless the latest security update is applied.

The CVSS score of 8.8 indicates high severity, and the EPSS score is currently unavailable, suggesting uncertain but non-negligible exploitation likelihood. The vulnerability is not in the CISA KEV catalog. The likely attack vector is a network-based delivery of a malicious workbook, such as via file sharing or email attachments. While no public exploit is known, the high CVSS and the ability to run code remotely make it a priority for patching.