Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network, potentially compromising the confidentiality, integrity, and availability of the affected system. The vulnerability can lead to arbitrary code execution, giving the attacker control over the host within the same network context. Based on the description, the likely attack vector is sending a malicious Excel document to a target that opens the file from a network location.

Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and Office Online Server are all affected by this heap‑based buffer overflow.

The CVSS score of 8.8 indicates a high severity vulnerability. EPSS is not available, so the exploitation probability cannot be quantified, but the lack of a KEV listing suggests the vulnerability is not currently widely exploited. An attacker would need to supply a crafted Excel file over the network and trigger the overflow through a legitimate Excel session. The high severity and remote nature of the attack vector underscore the importance of timely mitigation.