The vulnerability in Microsoft Office Excel is a use‑after‑free flaw that permits an attacker to execute arbitrary code on an affected system by loading a specially crafted file. The resulting memory corruption can compromise confidentiality, integrity, and availability of the host, and the weakness is classified as CWE‑416.

Affected products include Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021 and 2024, Microsoft Office LTSC for Mac 2021 and 2024, and Office Online Server. Version details are not supplied in the CVE, so the scope of affected releases cannot be determined.

The CVSS score of 8.8 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that widespread public exploitation has not yet been observed. The likely attack vector is network‑based, with an attacker delivering a malicious Excel file over a network to trigger the use‑after‑free. Successful exploitation would grant remote code execution, contingent on the target system allowing the vulnerable file to be opened. The absence of an EPSS value does not diminish the severity of this flaw.