A heap‑based buffer overflow occurs in Microsoft Office Excel. When an attacker supplies a specially crafted Excel file and a user opens it, the buffer overflow allows malicious code to be executed with the privileges of the account that opened the document. The flaw is classified as CWE-122 (Heap‑based Buffer Overflow) and CWE-193 (Off‑by‑One Error).

The vulnerability impacts Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. The affected versions for each product line are not listed in the current advisory, so any currently installed build of these products on macOS may be at risk.

The CVSS score of 8.8 indicates a high severity. The EPSS score is not available, suggesting limited publicly observed exploitation data. The flaw is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves an attacker delivering a malicious Excel file over a network and having a user open it, which would trigger the overflow and achieve code execution on the host. The lack of known mitigations and high severity mean the risk remains significant even if no exploits are currently known.