An uninitialized resource within Microsoft Office Excel permits an unauthorized attacker to execute code from a remote source, allowing successful exploitation when a user opens a malicious document. The flaw is an instance of improper resource handling as described by CWE‑763 and CWE‑908, and it can compromise system confidentiality, integrity, and availability.

Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024 are all susceptible. No per-version details are provided, so all current releases of these products should be considered vulnerable.

The CVSS score of 8.8 indicates high severity. EPSS data is unavailable and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is via a remote network, inferred from the description’s mention of network-based code execution. Successful exploitation would allow the attacker to run code on the target system, potentially enabling data theft, lateral movement, or system sabotage. The absence of a publicly documented exploit does not reduce the risk, as the flaw is already capable of remote exploitation by an unauthenticated actor.