The vulnerability is a use‑after‑free flaw in Microsoft Office Excel that lets an unauthorized attacker execute code over a network when a malicious workbook is processed. The flaw can be abused to run arbitrary code with the privileges of the user opening the workbook, potentially giving full control of the affected system. The weakness is identified as CWE-416.

Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and Office Online Server are all affected. No specific version numbers are listed, so any installation of the product families is potentially vulnerable.

The CVSS score of 8.8 indicates high severity, while the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited exploit evidence to date. Nonetheless, because the flaw enables remote code execution when an attacker can supply a malicious Excel file over the network, it poses a significant risk to users who open or sync files from untrusted sources. An attacker with network access to a user’s machine could trigger the use‑after‑free to run code with the user’s rights, potentially compromising the entire system.