Microsoft Office Excel is vulnerable to a use‑after‑free condition that allows an attacker to execute arbitrary code on a target system. Exploitation requires the delivery of a crafted Excel file or link over the network, after which the application incorrectly accesses freed memory, enabling arbitrary code execution in the context of the user. The flaw carries the CWE‑416 classification and can compromise confidentiality, integrity, and availability of the affected system.

The vulnerability affects a range of Microsoft Office products: Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and Office Online Server. No specific version numbers are listed, so all releases of the mentioned suites are potentially impacted.

The CVSS score of 8.8 indicates high severity. The EPSS score is not available, so the likelihood of exploitation cannot be quantified, but the vulnerability is listed outside the CISA KEV catalog. The attack vector is inferred to be network‑based, requiring an attacker to deliver a malicious file or link to a user. Once executed, the attacker gains full control over the affected workstation or online session.