A use‑after‑free flaw in Microsoft Office Excel permits an attacker to execute arbitrary code over a network. The vulnerability, categorized as CWE‑416, can lead to full system compromise, data exfiltration, or command execution on the affected host when a malicious Excel document or spreadsheet is processed.

Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024 are all impacted. No specific patch version is listed, implying that all current builds for these editions remain vulnerable until updated.

The CVSS score of 8.8 designates this vulnerability as high severity, and the EPSS score is not available. It is not listed in CISA’s KEV catalog. The likely attack vector is network‑based, with an attacker delivering a crafted Excel file or document to the vulnerable application. Because the flaw does not require local privileges or authentication, the risk of exploitation is significant for any system that processes untrusted Office content.