A use‑after‑free flaw in Microsoft Office Excel permits an unauthorized attacker to run arbitrary code over a network. The vulnerability is a classic memory corruption problem (CWE‑416) that can be triggered when Excel processes a specially crafted file received via a network channel. Successful exploitation grants the attacker full control of the affected system with the privileges of the user running Excel, enabling installation of malware, data exfiltration or pivot to other network services.

This flaw applies to multiple Office editions: Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and Office Online Server. All current releases of these products are affected, but the specific patched versions are not listed in the advisory. Users should verify that they are running the latest updates for any of these Office deployments.

The CVSS base score of 8.8 classifies the vulnerability as high severity. The EPSS score is not available, so precise exploitation probability cannot be quantified, and the vulnerability is not yet tagged in Microsoft’s KEV catalog. Based on the description, the likely attack vector involves delivering a malicious Excel file or workbook over a network connection to a user’s machine; the exploit would bypass standard application sandboxing by exploiting a memory bug. Breaches that successfully execute this flaw can lead to complete system compromise with minimal user interaction, making it a high‑risk target for attackers.