An integer underflow condition (wrap or wraparound) in Microsoft Excel enables an attacker to trigger execution of arbitrary code over a network. The vulnerability falls under CWE-191 and can compromise confidentiality, integrity, and availability of affected systems, allowing an attacker to run code with the privileges of the user who opens the document.

Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and Office Online Server. The affected versions are not specifically enumerated in the CVE data; any version that has not applied the latest update for this issue is at risk.

The CVSS score of 8.8 indicates a high risk. EPSS data is not available, but the vulnerability has not been listed in the CISA KEV catalog. Exploitation would likely involve network-based delivery of a malicious workbook or document, making the attack vector remote. The lack of an available exploit score suggests the possibility of low to moderate exploitation likelihood, yet the severity remains high enough to warrant immediate action.