A buffer underwrite flaw in Microsoft Office Excel permits an attacker to execute arbitrary code when a malicious spreadsheet is opened. The vulnerability arises from improper bounds checking during memory copy operations, allowing the attacker to write data before a buffer starts in memory. Depending on the environment and user privileges, the code runs with the same permissions as the victim, potentially granting full access to the host system.

The flaw affects Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and Office Online Server. Specific version ranges are not detailed in the published data; the impact is tied to the mentioned product lines.

The CVSS score of 8.8 classifies this as a high‑severity vulnerability. The EPSS score is not reported, and the vulnerability is not currently listed in CISA’s KEV catalog. Attackers can embed malicious content in a spreadsheet that, when opened from a network location or via a shared link, triggers the buffer underwrite and allows code execution. No additional prerequisites are noted beyond the ability to deliver a crafted file over a network.