An integer underflow (wrap or wraparound) flaw exists within Microsoft Office Excel, allowing an unauthorized attacker to execute arbitrary code over a network. The vulnerability is identified as CWE-122 (Heap-based Buffer Overflow) and CWE-191 (Integer Underflow). The descriptive text does not detail the exact attack vector, but it is inferred that processing a crafted Excel file could trigger the underflow and result in code execution.

Affected products include Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and Office Online Server. Version information is not specified in the advisory, so all current releases of these products are considered vulnerable.

The CVSS score of 8.8 places this vulnerability in the high severity range. The EPSS score is not available, implying that publicly reported exploitation evidence is limited, although a realistic exploitation scenario is inferred to likely involve an attacker delivering a malicious Excel document over the network. The vulnerability is not listed in CISA’s KEV catalog. While the descriptive text does not detail the exact attack vector, it is inferred that processing a crafted Excel file could trigger the underflow and result in code execution.