A stack‑based buffer overflow in Microsoft Office Excel enables an unauthorized attacker to run arbitrary code. The flaw resides in how Excel processes input data from an Excel file, leading to a vulnerability that can be exploited for remote code execution on a device that opens a malicious workbook. This weakness is classified as CWE‑121, which describes stack corruption failures that can compromise program control flow.

The affected products are Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and Office Online Server. Vendor‑specific version information is not specified in the disclosed data, so all current releases of the listed products are considered vulnerable.

The CVSS v3.1 score of 8.8 indicates high severity, and although there is no EPSS data available, the vulnerability can be exploited over a network by delivering a crafted Excel file to a victim. It is not listed in the CISA Known Exploited Vulnerabilities catalog, so no active exploitation is documented. The principal attack vector is the network, requiring an attacker to supply a malicious workbook that the user opens, either via email attachment or shared network location. The risk is significant for any environment where Excel files from untrusted sources are opened.