A heap‑based buffer overflow exists in Microsoft Office Excel that permits an unauthorized user to cause code to run on the local system. The flaw resides in how Excel processes certain data structures, allowing the attacker to overwrite adjacent memory locations and execute arbitrary instructions. If exploited, an attacker can compromise the confidentiality, integrity, or availability of the affected machine, potentially gaining full control of the system.

Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024 are impacted. The vulnerability is present in the base Excel application of these products and applies to all installations of those editions where the update has not been applied.

The CVSS score of 7.8 signals a high‑severity risk, while the EPSS score is currently unavailable, suggesting that publicly known exploitation may be limited or not yet observed. Based on the description, it is inferred that the flaw does not appear to be remotely exploitable over a network; an attacker must have local access or be able to trick a privileged user into opening a crafted Excel file. The vulnerability is not listed in the CISA KEV catalog, indicating no confirmed large‑scale attacks have yet exploited it.